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Abstract 

Cloud  computing  is  a  hot  topic  in  Information  Technology  with  providers’ 
worldwide  revenues  exeeeding  $130  billion.  While  new  technologies  bring  great 
promise,  they  have  the  potential  for  disruption  as  these  new  tools  potentially  ehange 
roles,  promise  unrealized  eapabilities,  and  bring  unantieipated  effects.  This  research 
investigates  one  such  technology,  examining  issues  and  perceptions  of  cloud  computing 
in  the  Department  of  Defense  (DoD).  The  first  part  of  the  study  replicates  a  2009  IDC 
Enterprise  panel  survey  of  eommercial  IT  professionals.  Eighty-three  military  IT 
professionals  were  surveyed  for  their  views  on  cloud  computing.  In  the  current  survey, 
more  military  IT  professionals  felt  system  availability,  performanee,  and  in-house 
integration  were  significant  concerns.  Conversely,  military  personnel  were  less  likely  to 
be  worried  about  unknown  on-demand  costs  or  reintegration  of  IT  serviees.  No 
difference  was  found  in  the  breadth  of  security  concerns  or  the  ability  to  eustomize 
software.  Of  particular  interest  were  the  concerns  on  cloud  computing  costs  and 
reintegration,  which  are  eounterintuitive  for  a  technology  promising  a  revolutionary 
approaeh  to  save  money  over  the  long  haul.  Next,  the  military  IT  personnel  survey  data 
was  used  to  understand  the  relationship  between  viability  pereeptions  and  willingness  to 
implement  the  teehnology.  Survey  data  was  analyzed  with  struetural  equation  modeling. 
The  model  showed  that  a  large  portion  of  perceived  viability  of  eloud  eomputing  is 
determined  by  the  cost  of  the  teehnology,  the  inertia  of  the  organization,  and  the  fit  of  the 
teehnology  with  the  organization.  Eurthermore,  willingness  was  significantly  related  to 
viability  perceptions  but  not  to  cost  concerns. 
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I  CAN,  BUT  I  WON’T:  AN  EXPLORATORY  STUDY  OF  PEOPLE  AND  NEW 

INFORMATION  TECHNOLOGIES 


I.  Introduction 


Overview 

According  to  the  National  Institute  of  Standards  and  Teehnology  (NIST),  eloud 
computing  “is  a  computing  model  that  enables  convenient,  on-demand  network  aceess  to 
a  shared  pool  of  eonfigurable  computing  resources  (hardware  and  software)  that  ean  be 
rapidly  provisioned  and  released  with  minimal  management  effort  or  service  provider 
interaetion.”  In  September  2009,  the  Federal  Chief  Information  Offieer,  Vivek  Kundra, 
announeed  the  Federal  Government’s  Cloud  Computing  Initiative.  This  initiative  laid  the 
groundwork  for  the  future  rapid  deployment  of  teehnology  solutions  supporting  the 
Federal  Government  without  developing  stove-piped  systems  (GSA,  2009).  Currently, 
the  Federal  Government,  considered  the  world’s  largest  purchaser  of  information  technology, 
spends  over  $76  billion  per  year  on  more  than  10,000  systems  (Kundra,  2009).  Correetly 
implemented,  the  cloud  computing  model  has  the  potential  to  dramatically  decrease 
information  system  eost  via  virtualization,  redueing  related  infrastrueture,  building, 
power,  and  staffing  expenditures  (GSA,  2009)  making  it  attraetive  to  any  eost-crunehed 
organization. 

Cloud  computing  centers  provide  a  foundation  to  run  enterprise  serviees  seeurely 
and  reliably  aeross  the  DoD.  By  leveraging  eloud  computing  techniques,  the  Department 
of  Defense  (DoD)  ean  transform  its  infrastructure  from  its  legacy  system-specific 
infrastructures  to  a  shared  infrastrueture  (CIO/DoD,  2010).  Some  reeent  examples  of 
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recent  cloud  computing  successes  in  commercial  industry  include  Kenworth  and  Coca- 
Cola  Enterprises.  Engineers  at  Kenworth,  lacking  organic  high-powered  computing 
capacities,  rented  time  on  a  supercomputer  thousands  of  miles  away  to  help  find  gas- 
guzzling  design  flaws.  The  Kenworth  engineers  took  advantage  of  cloud  computing  and 
discovered  the  mud  flaps  were  a  major  source  of  drag.  Redesigning  the  mud  flaps  will 
save  about  $400  on  a  typical  truck’s  annual  fuel  bill  (Eortt,  2009).  Coca-Cola  Enterprises 
uses  a  cloud-based  logistics  system  to  optimize  operations  with  merchandisers  in  the 
field.  Using  smart  phones  and  a  cloud  computing  setup,  personnel  responsible  for 
restocking  Coke  products  in  stores  stay  in  constant  contact  with  their  bosses  and  the 
company’s  information  storehouse.  This  allows  the  field  personnel  to  provide  automatic 
inventory  updates  and  last  minute  changes  to  merchandising  schedules. 

Cloud  computing,  while  trendy  as  a  new  computing  model,  it  is  not  new.  Since 
2009,  federal  agencies  have  been  able  to  buy  cloud  computing  applications  and  services 
at  Apps.gov.  GSA’s  Apps.gov  storefront  offers  an  array  of  business  applications, 
productivity  software,  and  services  ranging  from  social  networking,  to  website  hosting, 
and  data  storage  (Helft,  2009).  The  government  has  approved  these  cloud-based 
applications  and  services  to  replace  more  costly  and  demanding  computing  services  that 
are  owned  and  operated  by  federal  agencies.  Government  organizations  seeking  to  tap 
cloud-computing  benefits  are  not  constrained  to  simply  the  GSA  storefront.  In  July  2010, 
Google  announced  the  launch  of  Google  Apps  for  Government;  a  suite  of  Eederal 
Information  Security  Management  Act  (EISMA)  approved  cloud  services  for  "moderate"- 
level  security  requirements  (Google,  2010).  With  EISMA  approval,  government 
organizations  can  hire  Google  to  provide  secure  sensitive,  but  not  classified  information 
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systems,  processes,  and  data.  This  blend  of  government  and  commercial  providers 
affords  options  for  dramatically  changing  the  way  organizations  answer  their  IT  needs. 

Early  Successes  of  Cloud  Computing 

Williams  FI,  a  Formula  1  race  team  based  in  Oxfordshire,  U.K.,  turned  to  AT&T 
Global  Services  for  a  cloud  computing  solution.  The  Williams  FI  race  team  is  on  the 
road  for  9  months  out  of  the  year  competing  in  19  Formula  1  Grand  Prix  races  that  make 
up  the  race  calendar.  Its  headquarters  contains  a  fully  managed  enhanced  virtual  private 
network  that  allows  engineers,  mechanics,  car  designers  and  drivers  to  run  the  business 
while  they  are  on  the  road.  Alex  Bums,  CEO  of  Williams  FI,  states  that  their  IT  strategy 
used  to  be  about  speed  and  the  speed  of  decision-making  on  testing  and  accessing  the 
results  with  little  regard  for  security.  While  Williams  FI  is  a  tech  savvy  race  team  in  a 
competitive  and  high  profile  environment  replete  with  espionage,  it  knew  little  about 
security.  To  correct  this,  the  team  turned  to  a  cloud  provider  for  a  highly  secure 
infrastmcture  service,  allowing  their  own  IT  department  to  focus  on  helping  the 
organization  build  winning  racecars.  AT&T’s  cloud  security  services  enables  the 
Williams  FI  staff  to  receive  encrypted  data  from  the  car  to  make  decisions  during  the 
race.  Alex  Bums  said  that  by  using  cloud  computing,  the  team  saves  time  and  money 
since  security  services  require  constant  management,  patches,  new  hardware,  and  the  IT 
department's  time  (Del  Nibletto,  2010).  Burns  states  that  Williams  FI's  core  competency 
is  building  racecars,  not  IT  security,  nor  should  it  be. 

In  the  military  arena,  the  armed  services  were  assigned  the  task  of  finding  more 
than  $100  billion  in  overhead  savings  over  the  next  five  years  (Gates,  2010).  Any 
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savings  the  services  generate  can  be  reinvested  in  war-fighting  modernization.  At  least 
one  service,  the  U.S.  Army,  has  recently  stepped  out  and  looked  toward  cloud  computing 
as  a  means  to  cut  costs  and  increase  efficiency.  In  a  move  to  reduce  its  $10  billion  IT 
budget,  the  Army  issued  a  moratorium  on  server  purchases  (Foley,  2010)  to  reduce  server 
counts  and  consolidate  the  200+  Army  data-centers.  Spearheading  one  of  these  cost¬ 
cutting  efforts  is  the  United  States  Army  Recruiting  Command.  Their  Army  Recruiting 
Information  Support  System  was  over  10  years  old  and  in  need  of  an  upgrade  (Kundra, 
2010).  Therefore,  they  embarked  on  a  pilot  program  designed  to  explore  new 
technologies  that  the  Army  could  leverage  to  improve  efficiencies  of  its  recruiting 
operations.  Initial  bids  from  traditional  IT  vendors  that  met  the  required  functions  ranged 
from  $500,000  to  over  $I  million.  Instead  of  accepting  these  solutions,  the  Army 
Recruiting  Command  chose  a  customized  version  of  a  cloud-based  Customer  Resource 
Management  (CRM)  tool  from  Salesforce.  The  CRM  tool  from  Salesforce  provided  all 
the  functions  without  needing  to  acquire  all  the  necessary  hardware  needed  to  operate  a 
traditional  system.  The  Army  Recruiting  Command  is  currently  piloting  this  cloud-based 
solution  at  an  annual  cost  of  only  $54,000. 

In  a  broader  example  of  the  cloud  computing  movement,  in  201 1,  the  Army  will 
start  migrating  its  Microsoft  Exchange  email  users  to  an  enterprise-wide  email  that  will 
leverage  Army-owned  Microsoft  licenses  and  the  DoD  cloud  managed  by  the  Defense 
Information  Systems  Agency  (DISA).  The  base  email  service  enables  the  Army  to 
modernize  its  Microsoft  Server  software  and  increase  email  capabilities  while 
simultaneously  substantially  reducing  hardware  and  storage  expenses.  Estimated  savings 
may  reach  40%  (DISA,  2010).  According  to  the  DISA  press  release,  the  DISA-managed 
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Enterprise  Email  will  employ  fewer  servers  and  administrators,  inerease  seeurity  and 
eliminate  thousands  of  existing  heterogeneous  local  networks.  This  change  will  expand 
the  email  capability  with  email  storage  growing  to  4  gigabytes  for  most  users.  In 
contrast,  the  Air  Eorce’s  Air  Mobility  Command  (AMC)  revised  its  newly  restrictive  e- 
mail  limit  policy  in  January  2009.  The  new  limits  for  e-mail  size  are  divided  into  three 
Tiers.  Tier  I,  which  includes  Group  CC\CV  and  CMSgt  has  unlimited  size  of  e-mail 
boxes.  Tier  II  includes  CC,  CV,  CEM,  Eirst  Sergeant,  and  organization  accounts  are 
limited  to  250MB.  Einally,  normal  users.  Tier  III  are  limited  to  only  50MB  for  their  e- 
mail  box  storage.  This  is  one  of  the  many  examples  where  the  use  of  cloud  computing 
resources  can  reduce  costs  and  increase  efficiencies  while  maintaining  performance  and 
security.  These  examples  of  the  early  success  of  cloud  computing  reinforce  the  need  for 
this  research. 

Motivations  for  Research 

The  motivations  for  this  research  stems  from  personal  experiences  as  a  Signal 
Officer  for  an  Infantry  Battalion  and  a  Company  Commander  for  an  Operational-base 
Signal  Company.  While  serving  as  a  deployed  Signal  Officer  at  a  remote  Eorward 
Operating  base  in  Operation  IRAQI  EREEDOM,  there  were  many  areas  in  which 
communications  efficiency  and  capabilities  could  be  improved.  During  the  pre¬ 
deployment  and  post-deployment  process,  the  Signal  section  had  to  transfer  data  to  hard 
drives  and  file  servers  in  order  to  re-image  computers  so  they  could  connect  to  the 
respective  local  networks.  While  the  imaging  process  was  not  difficult,  the  process  of 
backing  up  the  users’  data  multiple  times  over  eighteen  months  due  to  training  exercises 
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and  deployments  was  time  consuming.  For  a  training  exercise  at  the  National  Training 
Center,  users’  data  had  to  be  backed  up  so  computers  could  be  re-imaged  for  the  network 
used  for  training.  This  process  was  done  after  returning  to  the  home  station,  before 
deployment  to  Iraq,  and  upon  returning  to  home  station.  By  comparison,  using  a  cloud- 
based  data  service  during  the  training  exercises  and  deployments  would  eliminate  the 
need  to  repeatedly  move  150  users’  data  back  and  forth  from  individual  computers  to  a 
server.  Instead,  the  data  would  reside  in  the  cloud  and  always  be  available. 

At  another  time,  as  a  Company  Commander  serving  in  Alaska,  I  encountered 
another  problem  with  a  potential  cloud-computing  solution.  The  Stryker  Brigade  soldiers 
possessed  multiple  email  addresses  that  were  used  during  deployments.  There  was  an 
Army  email  address  (xxx.us.army.mil),  an  email  address  at  work  (xxx.post.army.mil),  an 
email  address  for  the  Brigade  that  was  used  for  training  and  deployments 
(xxx.unit.army.mil),  and  SIPRnet  email  addresses  for  the  Army,  Post,  and  unit.  Multiple 
e-mail  addresses  used  during  garrison  and  deployed  operations  meant  multiple  accounts 
to  manage  at  one  time;  users  had  to  check  several  accounts  for  messages,  and  IT 
personnel  had  to  provide  support  for  each  set  of  exchange  servers.  Using  a  cloud-based 
email  service,  like  the  DISA  Enterprise  Email,  would  overcome  this  obstacle  since  doing 
so  would  eliminate  the  need  for  separate  post  and  unit  email  accounts.  Since 
implementing  cloud-computing  solutions  does  not  rely  on  multiple  exchange  servers,  it 
eliminates  the  need  to  manage  multiple  email  accounts.  These  examples  lead  to  the 
following  question:  If  cloud  computing  can  provide  cost  savings  while  still  meeting  the 
computing  needs  of  the  organization,  then  why  is  it  not  readily  implemented  through  the 
Department  of  Defense? 
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Research  Goals 


In  the  commercial  industry,  Kenworth,  Coca-Cola  Enterprises,  and  Williams  FI 
are  just  a  three  of  the  success  stories  of  how  cloud  computing  has  helped  organizations 
save  time  and  money.  Whether  saving  money  by  redesigning  the  aerodynamics  of  a 
truck,  or  optimizing  the  workload  of  merchandisers  working  in  the  field,  or  collaborating 
on  data  gathered  from  a  car  during  a  race,  cloud  computing  is  providing  advantages  in 
commercial  industries. 

The  same  advantages  are  only  beginning  to  be  seen  in  the  government  sector. 

The  Army  Recruiting  Command  is  saving  money  on  a  pilot  cloud  computing  solution  for 
the  aging  Recruiting  Information  System.  Similarly,  on  a  larger  scale,  the  Army  is 
transitioning  to  a  cloud-based  Enterprise  E-mail  system  that  is  supposed  to  increase 
capabilities  while  reducing  costs.  If  there  are  numerous  successes  using  cloud  computing 
technologies  in  commercial  industries,  then  why  has  it  not  been  implemented  as  quickly 
in  the  government  sector?  The  answer  to  this  question  is  the  thrust  of  this  research. 

There  are  two  main  research  goals  in  the  thesis.  The  first  goal  is  to  determine  if 
there  is  a  perceived  difference  of  opinion  between  commercial  and  government  sectors  on 
issues  concerning  cloud  computing.  By  comparing  the  results  from  a  2009  IDC 
Enterprise  survey  with  the  results  from  a  military  IT  Personnel  survey,  the  thesis  will 
determine  if  there  is  a  significant  difference  in  the  perception  of  cloud  computing  issues. 
Commercial  and  government  sectors  might  have  a  different  perception  on  cloud 
computing  issues  due  to  the  nature  of  their  organizations.  Government  and  commercial 
industries  have  different  customers,  stakeholders,  and  goals  driven  by  the  nature  of  the 
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two  industries.  For  one  example,  expenses  and  income  do  not  drive  the  government 
sector,  whereas  the  commercial  sector  pays  attention  to  profit  of  the  organization.  The 
differences  in  public  and  private  industry  can  mean  a  difference  in  technology  needs  and 
opinion  about  a  new  technology.  In  fact,  studies  on  information  systems  (IS)  projects  in 
the  commercial  sector  may  have  limited  relevance  due  to  differences  between  the 
government  and  commercial  industries  (Bozeman  and  Bretschneider  1986;  Bretschneider 
1990)  and  any  recommendations  derived  from  commercial  sector  studies  might  not 
necessarily  apply  to  the  government  sector  (Coase  1937). 

The  second  goal  of  the  thesis  is  to  understand  the  relationship  between  the 
perceived  viability  of  cloud  computing  and  perceived  willingness  to  implement  it  in  the 
organization.  Is  it  possible  that  cloud  computing  is  not  seen  as  a  viable  technology  in  the 
military  environment?  Conversely,  is  it  viable  and  IT  professionals  in  the  military  are 
just  unwilling  to  make  the  changes  needed  to  implement  it  in  their  organizations.  The 
previous  discussions  on  the  success  of  cloud  computing  leads  us  to  the  following 
questions. 

Research  Questions 

With  the  benefits  of  cloud  computing  seemingly  apparent,  the  reasons  why  it  has 
not  yet  been  adopted  may  lie  in  the  human  element  of  the  people,  process,  and 
technology  equation.  This  thesis  is  an  exploratory  examination  of  the  opinions  military 
IT  personnel  of  cloud  computing  in  the  in  the  Department  of  Defense  and  the  Army.  The 
research  presented  is  motivated  by  a  desire  to  understand  two  overall  research  questions: 
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(1)  Is  cloud  computing  perceived  as  a  viable  technology  in  the  DoD/Army? 

(2)  Is  there  a  perceived  willingness  to  implement  cloud  computing  in  the 
DoD/Army? 

The  research  will  provide  an  understanding  of  whether  DoD  IT  personnel  think 
cloud  computing  is  a  viable  technology  for  their  organization  as  well  as  examine  the 
connection  between  the  perceived  viability  of  new  technologies  and  the  willingness  of  IT 
personnel  to  implement  them.  Answering  these  questions  will  provide  a  framework  for 
determining  whether  new  technologies  are  viable  for  the  organization  and  the  perceived 
willingness  to  implement  the  technology. 

Thesis  Overview 

The  remainder  of  this  thesis  includes  four  more  chapters  and  supporting 
information  found  in  the  appendices.  This  next  chapter  introduces  cloud  computing, 
defining  and  explaining  the  varying  characteristics,  service  models,  and  deployment 
models.  Chapter  three  then  discusses  the  research  strategy  and  survey  methodology  used 
to  collect  the  data  required  to  address  the  research  questions.  Then,  chapter  four  presents 
the  analysis  of  the  survey  data  and  tests  the  research  model  to  answer  the  primary 
research  questions.  Chapter  five  discusses  the  results,  providing  recommendations  along 
with  possible  limitations  and  future  research  ideas. 
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II,  Background 


History  of  Cloud  Computing 

Recently,  cloud  computing  has  become  one  of  the  most  talked  about  topics  in 
information  technology  (Gartner,  2010).  The  Gartner  Group  (2010)  identified  cloud 
computing  as  the  primary  source  of  growth  in  IT  spending  with  global  revenues  surging 
to  over  $130  billion  in  2013.  Cloud  computing  is  on-demand  access  to  virtualized  IT 
resources  that  are  located  outside  of  your  own  datacenter  (Marks  and  Lozano,  2010). 
These  virtualized  IT  resources  are  accessed  over  the  Web,  shared  by  others,  easy  to  use, 
and  paid-for  through  subscriptions.  Significant  innovations  in  virtualization  and 
distributed  computing,  as  well  as  improved  access  to  high-speed  Internet  and  a  weak 
economy,  have  accelerated  interest  in  cloud  computing  (Lee,  2010). 

The  idea  behind  cloud  computing  dates  back  to  the  1960s  when  John  McCarthy,  a 
computer  scientist,  stated  in  a  speech  given  at  MIT,  “That  computing  may  someday  be 
organized  as  a  public  utility”  (Biswiss,  2011).  Cloud  computing  gets  its  name  from  a 
metaphor  for  the  Internet  (Velte  et  ah,  2010)  and  was  probably  copied  from  internet 
diagrams  (Biswiss,  2011)  where  data  is  depicted  as  traveling  from  one  computing  device 
to  another  through  a  nonspecific  cloud  (Figure  1). 


10 


Figure  1,  The  Internet  Cloud 

(http  ://singularityhub  .com/) 


In  such  a  model,  cloud  computing  providers  allow  users  to  remotely  aceess 
hardware,  software,  and  data  resources  for  a  fee.  Users  essentially  store  data  and 
applieations  in  the  “cloud”  for  easy  aeeess  (Figure  2).  There  are  several  commereial 
applications  utilizing  cloud  computing.  For  example,  OnLive,  an  online  gaming  service, 
provides  access  to  games  instantly  over  a  broadband  connection  using  a  browser. 
Similarly,  Google  Does  provides  a  web-based  document  editing  and  management  service, 
while  Bing  Maps  provides  an  on-line  mapping  serviee.  The  breadth  of  commercially 
available  serviees  available  via  this  model  eontinues  to  grow  (Geelan,  2009). 
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Figure  2,  Cloud  Computing  (Velte,  2010) 


What  is  Cloud  Computing? 

Commercial  industry  leaders  have  many  variations  of  the  cloud  computing 
definition  and  its  characteristics.  Accenture,  a  consulting  firm,  defines  cloud  computing 
as  the  dynamic  provisioning  of  IT  capabilities  (hardware,  software  or  services)  from  third 
parties  over  a  network.  In  another  view,  Kevin  Fogarty,  a  contributing  editor  at  CIO 
magazine  (2009),  states  that  the  cloud-computing  model  has  all  applications,  services  and 
networks  available  to  IT  and  end  users  via  the  Internet.  Meanwhile,  Jeff  Kaplan  from 
ThinkITStrategies  views  cloud  computing  “as  a  broad  array  of  web-based  services  aimed 
at  allowing  users  to  obtain  a  wide  range  of  functional  capabilities  on  a  ‘pay-as-you-go’ 
basis  (Geeelan,  2009).”  While  different,  at  the  core  these  definitions  all  have 
organizations  or  users  accessing  and  purchasing  IT  capabilities  from  a  third  party. 
Nonetheless,  they  are  not  the  only  ones  that  show  the  variety  of  perceptions  about  what 
cloud  computing  is. 
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According  to  TechTarget,  a  publicly  traded  IT  marketing  eompany,  eloud 
eomputing  is  a  general  term  for  anything  that  involves  delivering  hosted  serviees  over  the 
Internet.  Under  sueh  a  vision,  eloud  eomputing  has  all  three  distinet  eharaeteristies  that 
distinguish  it  from  traditional  IT  hosting:  serviees  are  sold  on  demand  (usually  by  the 
minute  or  the  hour),  serviees  are  elastie  (so  a  user  ean  have  as  mueh  or  as  little  of  a 
serviee  as  they  want  at  any  given  time),  and  the  serviees  are  fully  managed  by  an  external 
provider  allowing  eonsumers  aeeess  with  nothing  more  than  a  personal  eomputer  and 
internet.  One  eonsulting  firm  Lexnet  Consulting  Group,  defines  eloud  eomputing  as  a 
delivery  of  serviees  that  replaee  the  need  for  an  organization  to  ineur  infrastrueture  eosts; 
it  ean  be  thought  of  as  an  “outsoureed”  IT  network  (Chipman,  2010).  This  eloud 
represents  a  shift  away  from  eomputing  as  a  produet  to  eomputing  as  a  serviee  delivered 
over  the  Internet  (Khajeh-Hosseini,  Sommerville  and  Sriram,  2010).  Knorr  and  Gruman 
(Infoworld,  n.d.)  state  eloud  eomputing  eomes  into  foeus  when  one  eonsiders  what  IT 
departments  and  organizations  always  laek:  a  way  to  inerease  eapaeity  or  eapabilities 
when  needed  without  investing  in  new  infrastrueture,  training,  or  software  lieenses. 

Thus,  the  term  cloud  computing  can  be  used  to  eover  any  subscription-based  or  pay  per 
use  serviee  that  extends  existing  IT  eapabilities  (Knorr  and  Gruman,  n.d.). 

There  is  one  eommonality  for  almost  all  papers  and  definitions  of  eloud 
eomputing:  they  all  refer  to  or  referenee  the  National  Institute  of  Standards  and 
Teehnology  (NIST)  eloud  eomputing  model.  For  example,  see:  Bambaeus,  2008, 

Biswas,  2011,  Chipman,  2009,  DoD/CIO,  2010,  Foarty,  2009,  Geelan,  2009,  Khajeh- 
Hosseini  et  ah,  2010,  Kundra,  2008  and  2010,  Knorr  and  Gruman,  2010,  Lee,  2010, 
Lewin,  2009,  Marks,  2010,  Rhoton,  2009,  Rittinghouse  and  Ransome,  2010,  and  Wyld, 
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2009  and  2010.  Since  the  NIST  model  is  fundamental  to  so  many  eommereial  cloud 
computing  visions,  this  thesis  will  use  the  government’s  definition  of  cloud  computing 
which  was  published  in  January  2011  under  the  Federal  Information  Seeurity 
Management  Act  (FISMA  of  2002  in  Special  Publication  800-145).  The  NIST  defines 
cloud  computing  as  a  “model  for  enabling  ubiquitous,  convenient,  on-demand  network 
aceess  to  a  shared  pool  of  configurable  computing  resources  (e.g.  networks,  servers, 
storage,  applications,  and  services)  that  ean  be  rapidly  provisioned  and  released  with 
minimal  management  and  effort  or  service  provider  interaction.”  The  cloud  model 
promotes  availability  and  is  composed  of  five  essential  eharaeteristies,  three  serviee 
models  and  four  deployment  models  that  are  explained  below. 

The  five  essential  characteristics  are  on-demand  self-service,  broad  network 
access,  resouree  pooling,  rapid  elasticity,  and  a  measured  service.  The  three  service 
models  are  Software  as  a  Service  (SaaS),  Platform  as  a  Service  (PaaS)  and  Infrastructure 
as  a  Service  (laaS).  The  four  deployment  models  outlined  by  the  NIST  are  private  cloud, 
public  cloud,  community  cloud,  and  hybrid  cloud.  Further  details  are  provided  below. 

Five  Essential  Characteristics 

Characteristic  #1:  On  Demand  Self-Service, 

On-demand  self-service  occurs  when  a  consumer  ean  automatically  and 
unilaterally  provision  computing  capabilities,  sueh  as  server  time  and  network  storage, 
without  requiring  contact  with  the  providers’  customer  service  representative.  It  means 
the  consumer  can  use  the  eloud  service  as  needed  without  any  customer  service 
interaction  with  the  eloud  provider  (Ruggles,  2010).  One  example  is  from  VMware. 
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Their  vCloud™  Express  offers  an  on-demand  serviee,  where  developers  can  use  the 
service  at  their  convenience  to  address  various  infrastructure  and  programming  needs 
such  as  experimentation,  prototyping  and  testing.  A  vCloud™  customer  can  create  a 
virtualized  server,  add  storage,  configure  a  firewall,  and  scale  additional  capabilities  in 
and  out  according  to  what  and  when  they  need  it. 

Characteristic  #2:  Broad  Network  Access, 

Broad  network  access  is  an  essential  characteristic  defined  by  the  NIST  as 
capabilities  that  are  available  over  the  network  and  accessed  through  standard 
mechanisms  that  promote  use  by  heterogeneous  thin  or  thick  client  platforms  (e.g., 
mobile  phones,  laptops,  PDAs).  This  is  the  most  vital  characteristic  of  cloud  computing 
since  it  is  network  based,  and  accessible  from  anywhere,  from  any  standardized  platform 
(Velte,  2010).  This  does  not  necessarily  mean  Internet  access.  A  private  cloud  is 
accessible  only  behind  a  firewall,  regardless  of  the  type  of  network  (Ruggles,  2010).  The 
main  point  of  this  characteristic  is  that  the  service  is  accessible  from  anywhere. 

Characteristic  #3:  Resource  Pooling, 

Resource  pooling  is  the  next  characteristic.  In  resource  pooling,  numerous  clients 
use  the  same  set  of  resources  at  the  same  time  (Rhoton,  2009).  It  works  on  economies  of 
scale:  users  do  not  have  their  own  resources,  so  a  provider  gives  multiple  parties  access 
to  a  large  pool  of  shared  resources  at  efficiencies  no  one  user  could  match.  The  cloud 
computing  service  providers  make  their  resources  available  to  anyone  who  is  willing  to 
pay  for  access. 
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Characteristic  #4:  Rapid  Elasticity. 

The  characteristic  of  rapid  elasticity  is  defined  as  the  ability  to  scale  computing 
resources  both  up  and  down,  as  needed.  To  the  consumer,  the  cloud  appears  to  be 
infinite,  and  the  consumer  can  purchase  as  much  or  as  little  computing  power  as  needed 
(Ruggles,  2010).  This  characteristic  not  only  allows  the  services  to  be  scaled  both  up  and 
down  (scalability),  but  per-usage  billing  is  common  with  this  characteristic  and  this  leads 
to  direct  cost  savings. 

Characteristic  #5:  Measured  Service, 

The  last  characteristic  is  called  a  measured  service.  NIST  defines  this  as  the 
leveraging  of  a  metering  capability;  usage  can  be  monitored,  controlled  and  reported, 
providing  clear  usage  details  for  the  provider  and  consumer,  like  a  utility  service  model. 
Measured  services  allow  the  cloud  provider  to  charge  for  exactly  what  the  customer  is 
using.  The  customer  can  track  usage  and  costs  and  align  them  with  their  specific 
business  units  or  functions  for  cost  accountability. 

Three  Service  Models 

Besides  containing  the  five  essential  characteristics,  cloud  computing 
implementations  are  available  in  three  service  models:  Software  as  a  Service  (SaaS), 
Platform  as  a  Service  (PaaS),  and  Infrastructure  as  a  Service  (laaS).  These  models 
describe  the  level  of  functionality  offered  by  the  cloud  provider.  Figure  3  depicts  the 
relationships  between  the  models  as  a  pyramid.  At  the  highest  or  software  as  a  service 
level,  the  consumer  receives  more  functionality  and  customization  and  knows  less  about 
the  implementation  details.  At  the  lower  levels,  the  consumer  receives  more  components 


16 


in  the  service  and  a  higher  degree  of  control  over  the  infrastructure,  platform,  and 
software. 


Figure  3,  Cloud  Service  Models 


Service  Model  #1:  Software  as  a  Service, 

Software  as  a  Service  (SaaS)  provides  the  customer  the  ability  to  use  applications 
running  on  a  cloud  infrastructure  (NIST,  2011).  SaaS  offers  fully  functional  applications 
on-demand  to  provide  specific  services  such  as  e-mail,  customer  relationship 
management,  web  conferencing,  and  other  applications.  The  applications  are  accessible 
from  various  devices  though  a  thin  client  interface  (e.g.,  web  browser)  allowing 
consumers  to  avoid  upfront  investment  in  servers  or  software.  Salesforce.com  is  the  most 
well  known  example  among  enterprise  applications  (Knorr  and  Gruman,  2010).  Onlive, 
Google  Docs  and  Bing  Maps  are  other  well-known  examples  the  growing  number  of 
SaaS  providers.  For  example,  Google  Docs  allows  you  to  upload  files,  then  edit,  and 
view  the  documents  from  any  computer  or  smartphone.  This  fosters  real-time 
collaboration  with  other  authorized  users,  while  shielding  the  company  from 
implementation  details  such  as  software  installation,  updates,  and  patches. 
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Service  Model  #2:  Platform  as  a  Service, 


NIST  defines  Platform  as  a  Serviee  (PaaS)  as  another  serviee  model.  PaaS  allows 
the  eonsumer  to  deploy  their  own  applications  that  are  created  using  approved  software 
tools,  onto  the  cloud.  PaaS  falls  between  SaaS  and  Infrastructure  as  a  Service  since  it 
balances  functionality  with  control.  Consumers  use  PaaS  to  generate  custom  applications 
using  software  development  languages  and  tools  offered  by  the  vendor.  PaaS  offers  an 
operating  environment  that  includes  the  operating  system  and  application  services.  These 
services  are  constrained  by  the  vendor’s  design  and  capabilities.  PaaS  solutions  are 
development  platforms  in  which  the  development  tool  itself  is  hosted  by  the  provider  and 
accessed  through  a  web  browser.  Due  to  this,  developers  can  build  web  applications 
without  installing  any  tools  on  their  computer  and  can  deploy  those  applications  without 
any  special  system  administration  tools.  Examples  include  Force.com  by  Salesforce.com, 
Google  App  Engine,  and  Microsoft’s  Azure. 

Service  Model  #3:  Infrastructure  as  a  Service, 

Infrastructure  as  a  Service  (laaS)  is  where  the  consumers  are  provisioned  with 
processing,  storage,  networks,  and  other  fundamental  computing  resources  on  which  to 
deploy  and  run  any  software,  including  operating  systems  and  applications  (NIST,  2010). 
The  laaS  vendor  provides  a  virtual  machine  to  the  consumer  allowing  them  to  manage 
applications  and  data  while  the  vendor  manages  which  physical  machine  executes  the 
code.  Virtualization  enables  laaS  providers  to  offer  almost  limitless  instances  of  servers 
to  customers  and  make  cost-effective  use  of  the  hosting  hardware.  laaS  users  enjoy 
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access  to  enterprise-grade  IT  infrastrueture  and  resourees  that  would  be  prohibitively 
eostly  if  purchased  on  their  own.  Commereial  laaS  providers  include  Amazon’s  Elastie 
Compute  Cloud  (EC2),  Raekspaee,  and  GoGrid. 

Four  Deployment  Models 

Eaeh  of  the  preeeding  characteristics  and  platforms  are  aeeessed  through  different 
types  of  elouds,  also  known  as  deployment  models.  The  NIST  lists  four  different 
deployment  models  in  SP  800-145:  private,  publie,  eommunity,  and  hybrid  (Eigure  4). 

As  explained  below,  their  differenees  are  primarily  in  the  way  the  eonsumer  or 
organization  aeeess  serviees. 

Deployment  Model  #1:  Private  Cloud. 

Under  NIST,  one  deployment  model  is  the  private  eloud  infrastrueture,  which  is 
operated  solely  for  the  use  of  one  organization.  It  may  be  managed  by  the  organization 
or  a  third  party  and  may  exist  on  premise  or  off  premise.  The  private  eloud  is  operated  to 
maintain  a  consistent  level  of  security,  privacy,  and  governance  eontrol.  Organizations 
use  their  own  infrastrueture  and  private  eloud  to  operate  and  proteet  mission  eritieal 
systems.  By  operating  and  maintaining  a  private  cloud,  the  organization  has  to  buy  and 
manage  the  infrastrueture,  and  does  not  benefit  from  lower  upfront  eapital  eosts  (Eoley, 
2008). 
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Deployment  Model  #2:  Public  Cloud. 

The  public  cloud  infrastructure  is  made  available  to  the  general  public  or  a  large 
industry  group  and  is  owned  by  an  organization  selling  some  type  of  cloud  services.  In 
such  a  situation,  the  cloud  service  provider  makes  resources  available  to  the  general 
public  over  the  Internet.  These  services  may  be  free  or  on  a  pay-per-usage  model.  The 
benefits  of  a  public  cloud  service  are  that  they  are  easy  and  inexpensive  to  set  up  since 
the  provider  absorbs  the  hardware,  application,  and  bandwidth  costs.  In  addition,  they 
are  easily  scalable  to  meet  the  needs  of  the  consumer  and  are  paid  per  usage. 

Deployment  Model  #3:  Community  Cloud 

A  community  cloud  infrastructure  is  one  shared  by  several  organizations  and 
supports  a  specific  community  that  has  shared  requirements  (e.g.,  mission,  security 
requirements,  policy,  and  compliance  considerations)  (NIST,  2011).  This  type  of  model 
can  be  managed  by  the  organizations  (members  of  the  community)  or  a  third  party  and 
may  exist  on  premise  or  off  premise.  For  example,  a  financial  services  community  cloud 
would  bring  together  cloud-based  services  needed  to  assist  their  customers  while  still 
meeting  industry-specific  security  and  auditing  requirements. 

Deployment  Model  #4:  Hybrid  Cloud. 

The  last  deployment  model  is  a  hybrid  cloud.  NIST  states  that  the  hybrid  cloud 
infrastructure  is  a  composition  of  two  or  more  clouds  (private,  community,  or  public)  that 
remain  unique  entities  but  are  bound  together  by  standardized  or  proprietary  technology 
that  enables  data  and  application  portability.  For  example,  an  organization  that  keeps 
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their  data  in  a  private  cloud  while  using  the  processing  resources  of  a  community  cloud  is 
one  type  of  a  hybrid  cloud. 


r 


On  Premises  /  Internal  Off  Premises  /  Third  Party 

Figure  4,  Types  of  Cloud  Deployment  Models 

(Sam  Johnston,  2009) 

The  Silver  Lining  of  Cloud  Computing 

In  an  effort  to  reduce  costs  during  tough  economic  times,  cloud  computing  offers 
a  way  to  significantly  reduce  waste,  increase  data  center  efficiency  and  utilization  rates, 
and  lower  operational  costs  (Kundra,  2010).  Cloud  computing  benefits  are  analogous  to 
public  utilities  (Kundra,  2010).  Public  utilities  provide  access  to  clean  water  and 
electricity;  just  turn  on  the  faucet  or  the  light  switch  and  the  service  is  there,  and  the 
consumer  pays  for  only  what  they  use.  Cloud  computing  services  can  be  turned  on  and 
off,  as  the  organization  needs  them,  and  provide  a  pay-as-you-go  capability.  In  such  an 
approach,  only  a  low  initial  investment  is  required  to  get  started  (Kundra,  2010).  This 
lowers  the  barrier  of  entry  for  new  or  small  organizations  (Jaeger  et  ah,  2008).  Besides 
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the  direct  economical  benefit,  cloud  computing  can  save  maintenance  and  downtime, 
reduce  human  capital  required  to  manage  a  data  center,  and  better  accommodate  business 
growth  (Joyent,  2009).  Organizations  can  get  its  cloud  service  operational  in  record  time 
at  a  fraction  of  the  cost  of  an  on-premise  solution  (Waxer,  2010). 

Reducing  risk  is  another  benefit  of  cloud  computing.  Cloud  computing  allows 
individuals  and  businesses  to  reduce  some  risk  by  stating  in  the  service  contract  that  data 
protection  and  disaster  recovery  provisions  are  maintained  and  the  provider  is  liable  in 
the  case  of  failures  (Rhoton,  2009).  Furthermore,  by  using  a  cloud  provider,  an 
organization  can  reduce  the  likelihood  of  not  provisioning  enough  resources  for 
fluctuating  demand  and  reducing  the  risk  of  lost  revenue  due  to  unplanned  downtime. 
Elasticity,  which  can  also  be  called  scalability  (Waxer,  2010)  allows  IT  departments  to 
have  an  abundance  of  resources  for  peak  demand  can  add  or  subtract  capacity  as  its 
network  loads  dictate  (Waxer,  2010).  This  elasticity  allows  for  the  organization  to  pay 
for  only  what  is  used  (Kundra,  2010)  rather  than  purchasing,  installing,  and  configuring 
new  equipment  (Velte  et  al,  2010). 

Cloud  computing  also  offers  firms  potential  security.  System  security  under 
cloud  computing  promised  to  be  as  good  as  traditional  systems  since  cloud  providers  can 
devote  resources  to  solving  security  issues  that  smaller  business  cannot  afford  (Marks  and 
Lozano,  2010).  Google  (2010)  states  cloud  computing  provides  improved  security 
through  multiple  levels  of  redundancy  across  multiple  datacenters,  thereby  ensuring  data 
integrity  while  obscuring  it  from  tampering.  Cloud  providers  can  offer  services  that 
include  disaster  recovery,  monitoring,  forensic  readiness,  password  assurance,  and 
security  testing  (Rhoton,  2009). 
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There  are  several  different  types  of  effieieney  gains  realized  through  eloud 
eomputing.  Energy  efficiency  is  gained  through  the  use  of  higher  utilization  rates,  fewer 
servers  and  less  energy  consumption  (Kundra,  2010).  Organization  and  IT  department 
efficiency  is  gained  by  allowing  IT  personnel  to  concentrate  on  mission-critical  tasks  and 
less  time  on  IT  operations  and  maintenance  (Kundra,  2010;  Golden,  2008).  Moreover, 
cloud  computing  allows  organizations  to  convert  fixed  costs  to  variable  costs,  which  are 
only  paid  by  usage  and  can  be  tracked  by  the  departments  using  the  service  (Marks  and 
Lozano,  2010).  Cloud  computing  allows  for  the  increased  efficiencies  in  several  areas 
that  would  not  be  possible  using  traditional  computing  methods. 

As  discussed  above,  cloud  computing  offers  many  potential  benefits.  From  low 
initial  investment,  to  reducing  maintenance  and  down  time  costs,  to  increasing  security 
and  monitoring,  cloud  systems  allow  the  organization  to  be  more  flexible.  Even  though 
cloud  computing  implementations  offer  these  potential  benefits,  no  implementation  is 
risk  free. 

The  Dark  Side  of  the  Cloud 

There  are  also  some  risks  involved  in  implementing  cloud  computing.  Despite 
vendor  claims  of  improved  security  through  improved  expertise  and  redundancy,  security 
remains  a  sticking  point  for  this  new  model.  Information  Security  Magazine  (2009) 
states  that  information  security  is  the  most  crucial  risk  associated  with  cloud  computing. 
Making  intellectual  property,  trade  secrets,  personally  identifiable  information,  or  other 
sensitive  information  available  on  a  network  requires  a  large  investment  in  security 
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controls.  In  highly  sensitive  situations,  seeurity  and  other  business  requirements  may 
dietate  using  something  other  than  a  publie  cloud  regardless  of  vendor  assuranees. 

One  of  eloud  eomputing’s  oharaeteristies,  broad  network  aeeess,  is  a  both  benefit 
and  a  risk.  The  benefit,  mentioned  above,  is  that  employees  ean  aeeess  data  from 
anywhere.  The  risk  involved  is  that  network  eonneetions  are  suseeptible  to  outages  and 
subject  to  bandwidth  issues.  If  employees  try  to  aeeess  their  data  during  “peak  hours” 
(e.g.,  0900  hours  on  Monday),  then  the  eonneetion  speed  eould  suffer.  Should  the 
organization  be  driven  to  purehase  more  bandwidth  to  support  eloud  aeeess,  the 
expensive  upgrade  would  reduee  the  eost  benefit  of  eloud  eomputing. 

Finally,  data  privacy  is  another  issue.  Users  are  giving  their  data  to  a  eloud 
provider.  Cloud  serviee  providers  are  the  holders  of  very  large  amounts  of  sensitive  data 
and  law  enforeement  offieials  only  need  a  subpoena  to  aeeess  a  user’s  data  (Zittrain, 
2009).  When  users  plaee  their  data  and  applieations  on  eentralized  servers,  they  lose 
direet  eontrol  of  that  information.  Sensitive  information  that  was  once  stored  on 
organizational  eomputers  now  resides  on  the  servers  of  eloud  serviee  eompanies. 
Examples  inelude  user  email,  banking  information,  and  backups  of  individuals’  hard 
drive.  This  ereates  a  risk  for  the  users  sinee  storing  data  in  the  eloud  eould  inerease  the 
possibility  that  unwanted  third  parties  will  aeeess  this  data.  Some  eloud  eomputing 
providers  store  data  in  elear  text,  leaving  it  vulnerable  to  a  seeurity  violation.  By  stating 
in  the  eontract  with  the  eloud  serviee  provider,  data  ean  be  enerypted  in  transit  and  during 
storage  at  a  speeified  provider  loeation. 
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The  State  of  Commercial  Industry  Cloud  Computing 

Spending  on  worldwide  eloud  services  is  expected  to  surpass  $130  billion  in  2013 
(Gartner,  2010)  and  the  Cloud  Expo  in  Santa  Clara,  CA,  drew  more  than  5,000  delegates 
and  over  100  sponsors  and  exhibitors  in  November,  2010.  Indeed,  many  organizations  in 
the  commercial  sector  are  using  cloud  computing  to  attain  tremendous  savings  and 
reorganize  their  operations  (Kundra,  2010).  For  example,  the  NASDAQ  is  using  cloud 
computing  to  give  customers  a  snapshot  of  information  about  market  conditions  at  the 
time  of  the  trade  (Crosman,  2009).  Further,  a  list  of  some  companies  that  have  saved 
money  by  using  Google  Apps  include:  Genetech  (biotech  industry).  Virgin  America 
(airline  industry),  Salesforce,com  (customer  relationship  management  industry),  and 
Heinz  (U.S. -based  food  industry).  Related  to  this,  Morgans  Hotel  Group  deployed 
Google  Apps  for  messaging  and  collaboration  needs  to  its  1,750  employees  (Google, 
2009).  Additionally,  JohnsonDiversey,  a  global  provider  of  commercial  cleaning  and 
hygiene  products  and  solutions  chose  Google  Apps.  Google  helped  JohnsonDiversey 
migrate  its  12,000  employees  to  one  communications  platform,  lowering  its  IT  costs  and 
furthering  its  commitment  to  sustainability  through  the  elimination  of  energy-intensive 
email  servers.  These  are  just  a  few  examples  of  commercial  industry  using  a  cloud 
service  provider  to  obtain  cost  savings  and  reorganize  their  operations. 

The  State  of  Government  Sector  Cloud  Computing 

Cloud  Computing  is  currently  being  implemented  in  government  sectors  all 
around  the  world.  In  some  instances,  government  will  be  the  leading  sector  in  the 
development  of  cloud  computing  (Wyld,  2010).  In  January  2011,  the  NIST  published  a 
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draft  document  on  the  Guidelines  on  Security  and  Privacy  in  Public  Cloud  Computing 
that  provides  an  overview  of  publie  cloud  computing  and  the  seeurity  and  privaey 
ehallenges  involved  with  implementing  eloud  eomputing  in  the  government  seetor. 

Even  though  moving  to  a  eloud  eomputing  environment  can  reduce  eosts, 
standards  must  be  in  plaee  that  maintain  the  seeurity  of  government  information,  proteet 
the  privaey  of  the  eitizens,  and  safeguard  national  security  interests.  The  Federal 
Information  Seeurity  Management  Aet  (FISMA)  of  2002  requires  eaeh  federal  agency  to 
develop,  doeument,  and  implement  a  government-wide  program  to  provide  information 
seeurity  for  the  information  and  information  systems  that  support  the  operations  and 
assets  of  the  government,  including  those  provided  or  managed  by  another  ageney, 
eontraetor,  or  other  souree. 

Under  FISMA,  the  NIST  was  tasked  with  developing  the  standards  and  guidelines 
for  eategorizing  all  information  and  information  systems,  reeommending  the  types  of 
information  and  information  systems  to  be  ineluded  in  each  category,  and  developing  the 
minimum  information  seeurity  requirements  for  information  and  information  systems  in 
eaeh  eategory.  FISMA  defines  three  seeurity  objeetives  for  information  and  information 
systems  that  serve  as  the  basis  for  NIST’s  analysis:  eonfidentiality,  integrity,  and 
availability.  Confidentiality  means,  “Preserving  authorized  restrictions  on  information 
access  and  diselosure,  ineluding  means  for  proteeting  personal  privaey  and  proprietary 
information.”  Integrity  means  “guarding  against  improper  information  modifieation  or 
destruction,  and  includes  ensuring  information  nonrepudiation  and  authentieity.”  Finally, 
availability  means  “ensuring  timely  and  reliable  aeeess  to  and  use  of  information”  (44 
U.S.C.,  See.  3542).  Overall,  the  adoption  of  eloud  eomputing  in  the  government  seetor  is 
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still  in  its  infancy  though.  NIST’s  Guidelines  on  Security  and  Privacy  in  Public  Cloud 
Computing  and  other  government  organizations  are  still  just  beginning  to  examine  the 
eoneems  and  issues  of  eloud  eomputing. 

The  General  Serviees  Administration  (GSA)  is  one  of  the  larger  eloud  eomputing 
users.  Reeently,  the  GSA  moved  their  primary  information  portal  (USA.gov)  to 
Terremark’s  Enterprise  Cloud  Serviee  (Staten  et  ah,  2009).  In  doing  so,  GSA  migrated 
all  eore  resourees  for  the  USA.gov  web  portal  to  an  laaS  platform  giving  them  the  ability 
to  deploy  on-demand  resourees  as  web  traffic  increases.  Migration  to  the  eloud  has 
brought  benefits  and  savings,  sueh  as  avoiding  idle  server  eosts  while  still 
aecommodating  web  traffie  spikes,  aeting  on  users’  requests  in  real  time,  and  applying 
seeurity  eonstraints  on  top  of  this  platform  (Staten  et  ah,  2009). 

The  GSA  and  NASA  are  already  using  eloud  implementations  to  their  advantages 
and  realizing  some  benefits  or  using  the  serviees.  As  the  suceess  stories  beeome  more 
prevalent,  the  future  of  eloud  eomputing  in  the  government  seetor  will  likely  grow. 

U.S,  Government  Public  Sector  Cloud  Providers, 

NASA  recently  launched  NEBULA,  a  cloud  computing  based  service  that 
provides  highly-scalable,  high  performance,  on  demand  infrastructure,  platform,  and 
software  as  a  service  (Bambacus,  2010).  Nebula  is  an  open-source  cloud  computing 
project  developed  to  provide  an  alternative  to  building  new  data  centers  whenever  NASA 
requires  additional  data  processing  (NASA,  2010).  Nebula’s  laaS  provides  scalable 
computing  and  storage  for  NASA  users’  scientific  applications.  Nebula  enables 
significant  cost  savings  through  better  resource  utilization,  reduced  energy  consumption 


27 


and  reduced  labor  costs  associated  with  procuring  infrastructure  and  creating  new  web 
applications  (NASA,  2010).  Additionally,  the  Nebula  cloud  computing  platform  has 
become  the  home  of  the  Federal  Government’s  flagship  website  USAspending.gov 
(Kundra,  2010).  USAspending.gov  2.0  was  completely  reengineered  to  take  advantage 
of  the  cloud  computing  platform  at  Nebula.  By  tapping  the  capabilities  of  NASA’s 
Nebula  platform,  unused  capacity  is  available  for  use  by  other  government  agencies. 

Beyond  the  NASA,  the  Department  of  Interior’s  National  Business  Center  (NBC) 
provides  payroll  and  personnel  services  for  a  number  of  government  agencies  (Wyld, 
2010),  as  well.  The  NBC  offers  a  prepackaged,  integrated  development  environment 
including  a  software  development  tool,  applications  and  testing  tools  (NBC,  2010). 
NBC’s  private  federal  cloud  gives  federal  users  the  advantage  of  using  a  pool  of 
networks,  servers,  storage  capabilities,  and  desktop  applications  (SaaS)  in  a  NIST- 
certified  secure  dedicated  federal  environment.  Federal  organizations  and  agencies  can 
take  advantage  of  end-to-end  development  and  production  pipelines  on  an  as-needed 
basis  in  a  hosted  environment  (NBC,  2010). 

These  two  examples  of  cloud  computing  service  providers  can  be  classified  as 
government  sector  clouds  that  provide  for  themselves  and  other  government  sector 
consumers.  By  using  available  resources  from  other  government  agencies,  the  Federal 
Government  can  increase  the  efficiency  of  its  resources  and  reduces  IT  costs. 

U.  S.  Government  Sector  Cloud  Consumers. 

GSA  anticipates  that  cloud  computing  will  become  a  major  factor  in  reducing  the 
environmental  impact  of  technology  and  help  achieve  important  sustainability  goals 


28 


(McClure,  2010),  Besides  the  NASA,  GSA  and  NBC,  other  examples  of  federal,  state 
and  loeal  government  agencies  using  eloud-computing  technology  are  listed  in  Table  1. 


Table  1.  Federal,  State,  and  Local  Agencies  using  Cloud  Computing 

(Kundra,  State  of  Government  Sector  Cloud  Computing,  2010) 


FEDERAL  AGENCIES 

DoD  (U.S.  Army) 

Army  Experience  Center 

Department  of  the 

Interior 

Agency-wide  E-mail 

DoD  (U.S.  Army) 

Enterprise  E-mail 

GSA 

USA.gov 

DoD  (DISA) 

Rapid  Access  Computing  Environment 

GSA 

Agency-wide  E-mail 

DoD  (DISA) 

Forge.mil 

NASA  (Ames  Research) 

World-Wide  Telescope 

DoD  (USAF) 

Personnel  Services  Delivery 
Transformation 

NASA  (Jet  Propulsion 
Laboratory) 

Be  A  Martian 

DoE  (Lawrence 
Berkeley  National 
Labs) 

Cloud  Computing  Migration 

Social  Security 
Administration 

Online  Answers 
Knowledgebase 

Department  of 

Health  and  Human 
Services 

Supporting  Electronic  Health  Records 

Recovery  Accountability 
and  Transparency  Board 

Recovery.gov  Cloud 
Computing  Migration 

STATE  AND  LOCAL  AGENCIES 

State  of  Colorado 
(Office  of 

Information 

Technology) 

Launching  an  Enterprise  Cloud 

City  of  Canton  (Georgia) 

E-mail 

State  of  Michigan 
(Department  of 
Technology 
Management  and 
Budget) 

MiCloud 

City  of  Carlsbad 
(California) 

Communication  and 
Collaboration  Services 

State  of  New  Jersey 
(NJ  Transit 

Authority) 

Customer  Relation  Management 

City  of  Los  Angeles 
(California) 

E-mail  and  Office 

Productivity 

State  of  New 

Mexico  (Attorney 
General’s  Office) 

E-mail  &  Office  Productivity 

City  of  Miami  (Florida) 

3 1 1  Services 

Commonwealth  of 
Virginia  (IT 

Agency) 

Application  Development  Platform 

City  of  Orlando  (Florida) 

E-mail 

State  of  Wisconsin 
(Department  of 
Natural  Resources) 

Collaboration 

Klamath  County 
(Oregon) 

Office  Productivity 

State  of  Utah 
(Department  of 
Technology 

Services) 

Cloud  Computing  Services 

Prince  George’s  County 
(Maryland) 

School  District  E-mail 
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Foreign  Government  Public  Sector  Cloud  Computing 

Governments  in  other  eountries  have  adopted  eloud  eomputing  teehnologies  as 
well.  The  government  of  the  United  Kingdom  has  ereated  the  “G-eloud,”  a  government- 
wide  eloud  eomputing  network,  as  a  basis  for  funding  a  standardized  environment  for 
running  publie  serviees  (Gliek,  2009).  European  nations  are  also  implementing  IT 
solutions  around  eloud  eomputing  serviees  in  health  serviees,  management  of 
government  seetor  housing,  transportation  serviee  networks,  and  edueation  serviees 
(Wyld,  2010).  Japan’s  Ministry  of  Internal  Affairs  and  Communieations  plans  to  build  a 
massive  eloud-eomputing  infrastrueture  to  support  all  the  government’s  IT  systems 
allowing  the  various  ministries  to  integrate  hardware  and  platforms  to  promote 
standardization  and  eonsolidation  of  government’s  IT  resourees  (Rosenberg,  2009). 

China’s  efforts  in  eloud  eomputing  have  been  organized  by  loeal  governments 
and  leaders.  The  government  of  Wuxi,  in  order  to  attraet  more  firms  to  it’s  loeal 
eeonomie  development  projeet,  is  working  with  IBM  to  build  a  eloud  eomputing  eenter  to 
provide  on-demand  eomputing  serviees.  (Wyld,  2010).  The  Vietnamese  government  and 
universities  are  working  with  IBM  to  leverage  the  eloud  eomputing  model  to  help 
establish  a  new  department  ealled  Serviee  Seienee  Management  and  Engineering  in 
Hanoi  (Nystedt,  2009).  The  government  of  Thailand  is  preparing  to  set  up  a  private 
eloud-eomputing  platform  in  efforts  to  improve  development  and  implementation  of  e- 
eommeree  applieations  (Hieks,  2009). 

Cloud  eomputing  is  being  implemented  in  both  the  eommereial  and  government 
seetors.  Both  seetors  are  taking  advantage  of  using  either  using  a  publie,  private, 
eommunity  or  hybrid  deployment  elouds.  While  eloud  eomputing  is  still  in  the  beginning 
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stages  in  the  government  seetor,  commercial  industry  is  more  established  in  the  use  of 
cloud  computing.  Unfortunately,  the  successes  of  cloud  computing  in  the  commercial 
industry  might  not  translate  to  success  in  the  government  sector.  By  examining  current 
IS  theories,  the  perceived  viability  and  its  relationship  to  the  willingness  to  implement  a 
new  technology  can  be  ascertained. 

Current  Theories 

There  are  several  theories  that  might  be  used  to  test  the  adoption,  implementation 
and  success  of  information  systems  (IS)  and  information  technologies  (IT).  Since  the 
seventies,  research  has  contributed  to  develop  a  better  of  understanding  of  the  causes  for 
low  success  rates  of  implementing  costly  information  systems.  The  Technology 
Acceptance  Model  proposes  that  perceived  ease  of  use  and  perceived  usefulness 
influence  other  variables  on  technology  acceptance  (Davis,  1989).  The  DeLone  and 
McLean  IS  Success  Model  created  a  multidimensional  measuring  model  with 
interdependencies  between  different  success  categories  (DeLone  and  McLean,  1992). 

The  Computer  Self-Efficacy  Theory  demonstrated  the  utility  of  self-efficacy  to 
understand  individual  computing  behavior  (Compeau  and  Higgins,  1995).  The  Model  of 
PC  Utilization  confirms  the  importance  of  the  expected  consequences  of  using  PC 
Technology  (Thompson  et  ah,  1991).  Task-Technology  Fit  states  that  IT  will  have  a 
positive  impact  if  the  IT  capabilities  match  the  task  performed  by  the  use  (Goodhue, 
1998).  The  Fit-Viability  Model  proposes  that  the  fit  and  viability  of  the  technology  will 
increase  the  performance  (Fiang,  2007),  and  the  Fit- Appropriation  Model,  which  argues 
that  IS  performance  is  affected  by  fit  and  appropriation  support  (Dennis,  et  ah,  2001). 
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These  theories  have  been  used  to  both  predict  and  facilitate  the  use  of  IS.  Several  of 
these  theories  are  reviewed  in  the  following  pages. 

Technology  Acceptance  Model  (TAM) 

The  Technology  Acceptance  Model  (TAM)  was  written  by  Fred  Davis  in  1986  as 
a  Doctoral  dissertation  and  published  in  1989  in  Management  Information  Systems, 
Quarterly  (MISQ).  TAM  posits  that  perceived  ease  of  use  and  perceived  usefulness  are 
of  primary  relevance  in  the  acceptance  of  computers  and  IT  (Figure  5).  Davis  defined 
“perceived  ease  of  use”  as  the  degree  to  which  an  individual  believes  that  it  would  be 
effortless  to  use  a  particular  system.  He  defined  “perceived  usefulness”  as  the  degree  to 
which  an  individual  believes  that  use  of  a  particular  system  would  improve  job 
performance.  Thus,  TAM  posits  that,  taken  together,  these  two  beliefs  lead  to  a 
behavioral  intention  to  use  the  target  information  system  and  that  it  is  this  intention  that 
leads  to  actual  system  use.  He  tested  his  model  and  survey  scales  in  both  a  real-world 
setting  and  a  lab  experiment  and  found  good  support  for  it. 

Since  then,  TAM  has  been  used  as  a  foundation  to  study  many  different 
information  systems  and  technologies.  For  example,  Lederer  et  al  (2000)  extended  TAM 
to  examine  the  World  Wide  Web  (WWW).  They  revealed  that  the  ease  of  understanding 
a  web  site  by  a  user  and  the  ease  of  finding  the  web  site  by  a  user  predicted  ease  of  use 
while  information  quality  predicted  usefulness  in  a  revised  web  site.  In  another  study. 
Viability  of  TAM  in  Multimedia  Learning  Environments:  A  Comparative  Study  (Saade, 
Nebebe,  and  Tan,  2007)  extended  TAM  to  create  a  Multimedia  Acceptance  Model.  Their 
testing  determined  TAM  is  a  solid  theoretical  model,  which  can  extend  to  the 
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multimedia-learning  environment.  These  examples  show  the  utility  of  TAM  in  predieting 
users  acceptanee  of  a  variety  of  technologies. 

As  applied  to  cloud  computing,  the  Technology  Acceptance  Model  predicts  that 
cloud  computing  services  would  be  accepted  as  long  as  a  user  believed  it  would  be  easy 
to  use  and  would  improve  their  job  performance.  Some  of  the  benefits  of  cloud 
computing,  such  as  flexibility,  increased  efficiency,  cost-reductions  and  reliability,  can 
affect  whole  organization.  Cloud  computing  is  not  directly  aimed  at  improving  any 
particular  user’s  job  performance,  but  a  benefit  is  that  it  allows  the  organization  to  devote 
more  resources  to  running  the  business  instead  of  running  an  in-house  IT  department. 

The  TAM  model  focuses  on  the  end-user  of  a  system,  whereas  cloud  computing  affects 
the  entire  organization.  Therefore,  this  individual-level  model  is  not  the  appropriate 
model  to  use  to  answer  an  organization-level  research  question. 


Figure  5,  Technology  Acceptance  Model 
Source:  Davis  (1989),  Venkatesh  et  al,  (2003) 


33 


Task  Technology  Fit  (TTF) 

While  TAM  states  the  pereeived  usefulness  and  ease  of  use  are  relevant  to 
aeoeptanee  of  eomputers  and  IT,  Task  Teehnology  Fit  (TTF)  (Figure  6)  ean  be  deseribed 
as  “the  extent  that  teehnology  funetionality  matehes  task  requirements”  (Goodhue,  1995). 
TTF  argues  that  the  use  of  information  teehnologies  ean  produee  different  results 
dependent  on  the  eonfiguration  of  the  teehnology  and  the  speeifie  task  that  is  used  being 
aeeomplished.  Mueh  like  TAM,  TTF  has  been  extensively  tested. 


Figure  6.  Task-Technology  Fit 

The  Task  Teehnology  Fit  Theory  proposes  that  when  the  teehnology  fits  the  task 
and  user  abilities,  then  performanee  gains  should  be  expeeted.  Goodhue  and  Thompson 
studied  TTF  and  Individual  Performanee  (1995)  and  their  new  model  asserts  that 
information  teehnology  must  be  used  and  be  a  good  fit  with  the  tasks  that  it  supports  to 
have  a  positive  impaet  on  individual  performanee.  Zigurs  and  Buekland  (1998)  studied 
TTF  and  Group  Support  Systems.  Their  researeh  showed  that  an  appropriate 
task/teehnology  fit  should  result  in  higher  performing  groups.  They  found  that  fit  was 
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explicitly  defined  and  linked  to  group  performance.  They  also  found  that  task  complexity 
is  a  fundamentally  important  aspect  of  task  and  is  relevant  in  a  Group  Support  System 
environment. 

Fit  has  been  studied  at  many  levels.  Task-Technology  Fit  (Goodhue,  1995  and 
Goodhue  and  Thompson,  1995)  measure  fit  at  the  individual  level.  Zigurs  and  Buckland 
(1998)  measure  TTF  at  the  group  level.  TTF  has  also  been  measured  at  the  user  level  in 
e-tourism,  user  computer  self-efficacy  and  in  knowledge  management  (Turner  et  ah, 
2006).  Usoro  et  al.  (2010)  combined  TTF  and  TAM  to  study  e-Tourism.  They  chose 
TTF  since  it  was  reasonable  to  expect  that  the  consumer  will  favor  e-commerce 
applications  that  match  their  shopping  tasks.  Another  example  of  examining  TTF  was  by 
Gebauer,  Shaw  and  Gribbins  (2010).  They  built  on  previous  TTF  research  and  presented 
a  model  establishing  the  fit  between  managerial  tasks,  mobile  information  technology, 
and  the  mobile  use  context,  supporting  that  a  good  fit  positively  affects  task  performance. 

Cloud  computing  provides  benefits  at  the  organization  level,  so  expanding  TTF  to 
examine  if  the  cloud  computing  technology  would  fit  with  the  organizations  computing 
tasks/needs  is  the  next  step  in  examining  TTF. 

Fit-Viability  Model  (FVM) 

The  Fit  Viability  Model  (FVM)  expands  on  the  task-technology  fit  model. 
Anthony  Tijan,  founder  and  executive  vice  president  of  a  consulting  firm,  developed  the 
original  Fit-Viability  Model  (FVM)  in  2001.  Developed  from  working  on  more  than  100 
consulting  projects  with  a  wide  range  of  companies  that  were  examining  Internet 
initiatives,  Tijan  replaced  two  criteria  used  in  portfolio  analysis  with  business  viability 
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and  business  fit.  Business  viability  captured  qualitative  data  about  a  likely  payoff  or  an 
investment  and  fit  measured  the  degree  in  which  the  investment  matches  a  company’s 
processes,  capabilities,  and  culture.  Taken  together,  these  two  constructs  were  used  to 
predict  the  eventual  performance  of  a  portfolio.  With  only  slight  modifications,  this 
model  has  been  used  to  specifically  address  the  adoption  of  a  new  technology. 

Liang  and  Wei  (2004)  studied  the  adoption  of  mobile  technology  in  business.  At 
the  time,  there  were  few  studies  on  how  organizations  decide  on  adopting  new  (mobile) 
technologies  and  which  factors  determine  the  success  or  failure  of  adopting  this  new 
technology.  In  the  revised  FVM  (Liang  and  Wei,  2004;  Liang  et  ah,  2007),  the  Fit- 
Viability  model  integrates  task-technology  fit  with  the  general  belief  of  organizational 
viability  of  information  technology.  According  to  their  model,  fit  measured  the  extent  to 
which  a  feature  of  a  technology  matches  the  needs  of  the  task.  Viability  measured  the 
extent  to  which  the  organizational  infrastructure  is  prepared  for  adopting  the  technology 
(Figure  7). 


Figure  7,  Fit-Viability  Model 

In  FVM,  the  TTF  framework  is  modified  to  use  more  objective  assessment  of  the 
match  between  the  task  and  the  technology  without  considering  the  abilities  of  the 
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individual.  In  their  Adoption  of  Mobile  Technology  in  Business  (2007),  only  the  nature  of 
the  teehnology  and  the  requirement  of  the  task  were  eonsidered  for  fit.  For  mobile 
teehnology,  mobility  and  reaehability  were  two  features  for  measuring  fit.  If  the 
requirements  of  task  coineide  with  these  qualities,  its  fit  with  mobile  teehnology  would 
be  high  and  higher  performanee  would  be  expeeted. 

In  the  FVM,  viability  was  defined  as  the  extent  to  whieh  the  organization  is  ready 
for  the  teehnology  and  was  posited  to  be  influenced  by  economic  feasibility,  technical 
infrastructure,  and  the  social  readiness  of  the  organization  (Liang  et  al,  2007).  Economic 
feasibility  was  measured  by  assessing  the  cost  benefit  of  an  IT  project  to  determine 
whether  it  can  bring  financial  or  intangible  returns  and  determine  whether  the  IT  project 
could  bring  a  competitive  advantage.  In  the  Fit-Viability  framework  (Figure  8),  a  high 
viability  and  high  fit  would  result  in  the  technology  being  a  good  target  to  implement. 

High 

Mabiht)- 

Low 

Lovs'  High 

Fit 

Figure  8,  Fit-Viability  Framework 

In  the  FVM  (Liang  et  ah,  2007),  the  technical  infrastructure  was  defined  as  being 
composed  of  the  IT  platform  and  the  information  service  required  for  supporting  the 
application.  Liang  et  ah,  (2007)  concluded  that  the  technical  infrastructure  of  an 
organization  includes  computing,  information  management,  and  the  associated 
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communication  platform.  The  IT  infrastructure  provides  the  basis  that  supports 
technological  operations  and  augments  business  development. 

The  final  factor  of  viability  includes  the  social  readiness  of  the  organization. 

Liang  et  ah,  (2007),  state  that  user  satisfaetion  and  system  usage  are  two  common  criteria 
for  evaluating  the  success  of  IS  implementation.  The  organizational  factors  used  in  the 
FVM  model  include  the  process  reengineering,  employee  acceptanee,  and  top 
management  support.  Liang  and  colleagues  saw  the  influence  of  business  processing 
reengineering,  user  eompetence  and  top  management  support  as  fundamental  infiuenees 
indicating  organizational  readiness. 

Several  theoretical  and  practical  contributions  resulted  from  their  study.  They 
coneluded  that  organizations  should  consider  both  system  fit  and  viability  when 
eonsidering  adoption  of  a  new  teehnology,  mobile  teehnology  in  this  ease.  Previous 
research  focused  on  either  the  fit  or  organizational  factors,  which  were  not  complete  by 
themselves.  The  Liang  study  validated  the  FVM  framework  and  showed  its  practical 
applicability.  Using  the  framework  in  Figure  8,  organizations  can  determine  whether  an 
information  technology  is  fit  and  viable  for  the  organization,  or  whether  changes  need  to 
be  made  to  the  organization  or  the  technology. 

One  limitation  of  this  theory  was  that  it  needed  to  be  expanded  to  other 
teehnologies  or  issues  other  than  mobile  teehnology  (Liang  et  ah,  2007).  One  of  the 
goals  of  this  thesis  was  to  test  a  new  model  where  fit  and  viability  affect  organizational 
willingness  to  implement  cloud  computing. 
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Viability-Willingness  Model  for  Cloud  Computing 

The  fit-viability  model  was  adapted  to  help  answer  this  thesis’  seeond  research 
question.  It  was  specifically  adapted  to  help  determine  whether  a  new  technology  (i.e., 
cloud  computing)  is  a  viable  option  for  implementing  in  an  organization  and  if  the 
organization  is  willing  to  implement  the  technology.  This  new  Viability-Willingness 
Model  (VWM)  posits  that  the  cost  of  the  technology,  along  with  the  organizational  inertia 
and  the  fit  of  the  technology  leads  to  a  perception  of  viability,  which  in  turns  leads  to  a 
perception  of  willingness  to  implement  the  technology.  Cost  has  both  a  direct  and  an 
indirect  relationship  with  perceptions  of  willingness.  Further  definitions  and  related 
hypotheses  are  detailed  below  (Figure  9). 


Figure  9,  Research  Model:  Viability-Willingness  Model 


Cost, 

Gartner  (2008)  states  the  total  cost  of  ownership  (TCO)  model  includes  the  cost  of 
hardware  installation,  software  optimization,  warranty  and  any  license  or  maintenance 
agreements,  IT  labor  and  PC  support  costs,  maintaining  security  assurance  and  software 
upgrades.  Gartner  (2008)  also  includes  cost  analysis  of  mobility  requirements;  migration 
costs  and  planned  long-term  expenses  such  as  capital  expenditures,  and  lifecycle 
replacement.  The  TCO  model  should  act  as  a  framework  to  help  understand  major  cost 
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categories  assoeiated  with  eost-ownership.  In  addition,  eost/benefit  analysis  must  inelude 
tangible  and  intangible  eosts  and  benefits  including  network  stability  and  bandwidth 
eonstraints.  Cloud  eomputing  promises  to  out  operational  and  oapital  eosts  and  let  IT 
departments  foous  on  strategio  projeots  instead  of  keeping  datacenters  operational  (Velte 
et  ak,  2010). 

The  VWM  proposes  that  if  costs  of  a  new  teohnology  are  peroeived  to  be  more 
than  the  ourrent  teohnologies,  then  the  peroeptions  of  viability  of  the  new  teohnology 
would  be  expected  to  deorease.  Cost,  while  related  to  the  peroeived  viability,  oould  also 
be  direotly  related  to  the  peroeived  willingness  to  implement  the  teohnology.  Peroeptions 
of  only  a  limited  oost  savings  from  implementing  a  new  teohnology  would  be  expeoted  to 
adversely  affeot  the  organization’s  willingness  to  adopt  that  teohnology.  Therefore  it  is 
hypothesized  that: 

HI:  Cost  is  negatively  related  to  the  organization ’s  willingness  to  implement 

cloud  computing  in  the  Department  of  Defense. 

H2:  Cost  is  negatively  related  to  the  perceived  viability  of  cloud  computing  in  the 

Department  of  Defense. 

Organizational  Inertia, 

Organizational  inertial  is  the  degree  to  whioh  members  of  the  organization  have 
been  motivated  to  learn,  use  and  aooept  new  systems  (Seddon,  2010).  The  unit  of 
analysis  ohosen  for  assessing  organizational  inertia  is  the  organization,  not  the  individual. 
In  older  organizations,  systems  and  behavior  tend  to  beeome  institutionalized,  acting  as  a 
source  of  organizational  inertia,  whieh  limits  the  ability  of  organizations  to  adapt 
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(Hannan  and  Freeman,  1977).  As  organizations  age  and  get  better  at  replicating  routine, 
they  also  become  more  inert  (Hannan  and  Freeman,  1984).  Hannan  and  Freeman  (1984) 
also  argue  that  an  organizational  change  creates  a  liability  of  newness  that  exposes 
organizations  to  a  higher  risk  of  failure. 

Change  in  an  older  organization  creates  new  roles  and  new  relationships  similar  to 
those  of  a  new  organization  (Brown,  2002).  During  implementation  of  the  technology 
and  follow-on  upgrades,  substantial  energy  is  spent  on  change-management,  training,  and 
support  to  overcome  organizational  inertia.  Each  project  is  different,  so  organizational 
inertia  is  measured  for  each  project  (Seddon,  2010).  Since  cloud  computing  has  different 
service  models,  implementing  cloud  computing  is  considered  one  project  for  this  thesis 
instead  of  multiple  projects  encompassing  different  services.  Organizational  inertia  is 
important  for  determining  whether  the  organization  is  likely  to  accept  change  or  not. 

Since  inertia  limits  the  ability  of  the  organization  to  adapt,  high  organizational  inertia 
would  reduce  the  viability  of  a  new  technology.  Thus: 

H3:  Organizational  inertia  is  negatively  related  to  the  viability  of  cloud 

computing. 

Fit, 

Drawing  from  Zigurs  and  Buckland’s  (1998)  definition  of  fit,  we  define  fit  as  the 
match  of  the  computing  platform  with  the  computing  needs  of  the  organization.  Fit  is 
important  to  determine  whether  cloud  computing  technology  is  suitable  for  the 
organization’s  computing  needs.  If  the  IT  staffing  personnel  do  not  agree  that  it  is  a  good 
fit  for  the  organization,  then  viability  is  expected  to  decrease.  Therefore: 
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H4:  The  fit  between  cloud  computing  and  the  organization ’s  computing  needs  are 

positively  related  to  viability  of  cloud  computing. 

Viability, 

Viability  is  defined  as  the  extent  to  whieh  the  organization  is  ready  to  implement 
new  technologies  considering  the  economic  feasibility,  IT  infrastructure,  and  readiness  of 
the  organization  (Liang  et  ah,  2007).  The  viability  construct  has  three  influences  that 
determine  whether  a  new  technology,  cloud  computing  in  this  case,  is  viable  for  an 
organization.  The  total  cost  of  ownership  of  using  or  operating  the  technology 
determines  the  economic  benefits.  The  inertia  of  the  organization  determines  if  the 
organization  quickly  adapts  to  new  ideas  and  technologies.  Finally,  the  technology  must 
fit  the  needs  of  the  organization.  Those  three  forces  influence  whether  a  new  technology 
will  be  viable.  Viability  is  important  in  determining  if  the  technology  is  of  practical  use 
in  the  organization  and  helps  determine  the  willingness  to  adopt  a  new  technology. 

H5:  Viability  of  cloud  computing  is  positively  related  to  the  willingness  to  adopt 

of  cloud  computing. 

Willingness. 

Willingness  is  defined  as  being  disposed  to,  inclined  toward  or  openness  to 
something.  While  there  are  not  many  studies  in  willingness  to  implement  or  adopt 
information  systems,  there  are  several  conceptual  models  that  discuss  willingness. 

Werner  (2004)  proposes  that  a  willingness  to  use  telemedicine  was  affected  by  the 
participants’  attitudes  towards  telemedicine,  the  relationship  between  the  patient  and 
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physician  and  the  level  of  anxiety  toward  teehnology.  Chambers  et  al.  (2003)  examined 
the  impact  of  certain  personality  types  and  inclination  to  use  teehnology.  Using  the 
Myers-Briggs  Type  Indieator  and  a  questionnaire  designed  to  use  technology,  they  found 
that  intuitive/thinking  types  of  personalities  were  more  likely  to  use  teehnology.  Turner, 
Thomas,  and  Reinsch  (2004)  followed  communication  scholars  in  predicting  that  the 
perceived  attributes  of  a  new  teehnology  will  significantly  affect  the  willingness  to  try  the 
teehnology.  They  argued  that  task  situations  (types  of  medieal  care  in  their  study)  would 
affect  the  relative  importance  of  the  perceived  attributes. 

In  applying  the  VWM  to  cloud  computing,  the  perception  of  willingness  is 
defined  as  the  openness  to  implement  cloud  computing  in  the  organization.  The 
perceived  viability  of  eloud  eomputing  and  the  cost  of  cloud  computing  are  posited  to 
affect  the  willingness  eonstruct.  Perceived  willingness  is  how  comfortable  or  open  the 
organization  is  to  the  new  technology.  Cost  is  directly  and  negatively  related  to 
perceived  willingness  since  the  cost  of  implementing  and  using  the  technology  could 
affect  whether  the  teehnology  is  implemented.  In  addition,  viability  is  positively  related 
to  the  pereeived  willingness.  If  the  teehnology  is  a  viable  option  for  the  organization, 
than  there  should  be  an  increase  in  the  willingness  to  implement  the  technology.  Having 
established  the  theoretieal  foundation  for  this  thesis,  chapter  three  discusses  how  the 
subsequent  researeh  was  conducted. 
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III.  Methodology 


The  Research  Strategy 

This  thesis  examines  the  appropriateness  of  eloud  eomputing  as  an  IT  model  for 
the  DoD.  To  address  the  two  researeh  questions  and  test  the  hypotheses  takes  two 
eomplimentary  approaehes.  The  first  approaeh  is  to  eompare  pereeptions  of  eloud 
eomputing  between  the  eommereial  industry  IT  personnel  and  DoD  IT  personnel.  The 
seeond  approaeh  is  to  test  the  theory  and  relationships  in  the  Viability-Willingness  Model 
for  eloud  eomputing  in  order  to  examine  the  relationship  between  viability  and 
willingness  to  implement  a  new  teehnology.  The  results  from  these  two  efforts  will 
provide  answers  to  the  researeh  questions. 

A  survey  methodology  was  seleeted  for  both  approaehes.  The  survey  method  was 
seleeted  sinee  its  purpose  is  to  deseribe  attitudes,  beliefs,  and  behaviors  and  is  also  a 
eommon  tool  used  for  testing  a  eertain  theory  or  eausal  relationships.  Surveys  are 
developed  to  deseribe  the  attitudes,  beliefs  and  behaviors  of  a  population  (Patten,  2009). 
Researehers  seleet  a  sample  of  the  population,  study  the  sample,  and  then  make  an 
inferenee  to  the  population  from  the  sample  data.  Surveys  ean  also  be  quantitative 
researeh.  That  is,  results  from  the  survey  are  easy  to  quantify  whieh  allows  for  statistieal 
analysis. 

Survey  Development 

This  survey  was  developed  speeifieally  to  address  the  viability  of  eloud 
eomputing  and  the  willingness  to  adopt  eloud  eomputing.  Throughout  the  researeh,  it 
was  diseovered  that  there  were  few  studies  that  addressed  eloud  eomputing  at  the 
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organization  level.  The  vast  amount  of  surveys  addressed  the  use  or  aeoeptanee  of  a 
teehnology  that  was  already  implemented.  Sinee  sueh  approaehes  do  not  speeifieally 
meet  the  needs  of  this  researeh,  a  survey  was  exelusively  designed  for  the  VWM.  The 
only  eonstruet  for  whieh  questions  were  previously  validated  was  the  organizational 
inertia  questions.  The  remainder  of  the  questions  was  developed  to  address  the  construets 
in  the  model  and  to  match  a  question  in  the  IDC  Enterprise  panel  survey.  All  questions 
were  tested  in  a  pilot  study  to  verify  that  they  addressed  the  individual  constructs.  After 
editing  the  questions,  the  survey  was  tested  one  final  time  before  being  distributed  to  the 
sample. 

Survey  Structure 

All  questions  that  address  hypotheses  in  the  model  are  based  on  a  five-point 
Likert  scale  where  1  is  represented  as  the  strongly  disagree  or  the  most  negative  aspect  of 
the  question  and  5  represents  strongly  agree  or  the  most  positive  aspect  of  the  question. 
The  survey  is  broken  down  into  multiple  sections  (Appendix  B),  each  section  addresses  a 
hypothesis  of  the  model.  The  sections  of  the  survey  are:  Cloud  Computing,  Economic 
Impact,  Organization  Information,  Reforming  Eederal  Information  Technology 
Management,  and  Demographics. 

The  sections  relate  to  hypotheses  and  have  several  specific  questions  that  address 
aspects  of  each  hypothesis.  The  first  part  of  the  survey  develops  the  respondents’ 
knowledge  of  cloud  computing,  how  well  cloud  computing  aligns  with  their 
organization’s  computing  needs,  and  the  issues  surrounding  cloud  computing.  The  next 
section.  Economic  Impact  addressed  economic  aspects  of  implementing  cloud 
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computing.  The  third  section  of  the  survey,  Organization  Information,  examines  the 
effect  of  cloud  computing  in  the  organization.  The  fourth  section.  Reforming  Federal 
Information  Technology  Management,  analyzes  whether  organizations  are  willing  to 
implement  cloud  computing  using  different  types  of  service  providers.  The  last  section 
records  the  demographics  of  the  sample. 

Survey  Sample 

A  sample  of  convenience  was  used  in  this  study  since  it  was  not  possible  to 
contact  all  IT  personnel  across  the  Armed  Services,  the  DoD,  and  the  various  DoD 
civilians  and  contractors.  The  sample  is  from  a  list  of  IT  personnel  from  the  U.S.  Army 
Information  Systems  Managers  Functional  Area  53  list  hosted  by  the  U.S.  Army  Military 
Academy  (53Listserve). 

Army  Information  Systems  Managers  were  selected  as  the  primary  sample  from 
the  DoD  IT  personnel  population.  Information  Systems  Managers  are  usually  trained  at 
Fort  Gordon,  work  in  a  variety  of  positions  ranging  from  Automation  Staff  Officers,  who 
work  on  computers,  networks,  and  manage  information  systems  to  positions  in  the  DoD 
and  Army  CIO/G6  that  work  in  policy  and  procedures.  Additionally,  other  DoD 
information  technology  personnel  were  invited  to  participate  in  the  survey. 

Data  Analysis 

To  determine  the  appropriate  sample  size  needed  to  answer  the  research 
questions,  a  power  analysis  was  conducted  according  to  the  procedure  outlined  by  Cohen 
(1992).  The  power  analysis  revealed  64  survey  responses  were  required  to  detect  the 
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expected  medium  effect  size  statistical  difference  in  the  sample.  Therefore,  data 
collection  continued  until  83  useable  responses  were  obtained. 

To  compare  the  results  on  the  question  on  the  issues  of  cloud  computing  between 
the  two  surveys,  a  Z-test  is  used.  A  Z-test  compares  the  sample  and  population  means  to 
determine  if  there  is  a  significant  difference  between  the  samples  when  the  sample  is 
large  (n>30).  The  Z-value  for  the  95%  confidence  interval  is  +-  1.960.  If  the  sample 
returns  a  test  statistic  of  less  than  1 .960  then  we  fail  to  reject  the  null  hypothesis.  If  the 
test  statistic  is  more  than  +-  1.960,  then  we  reject  the  null  hypothesis  since  the  samples 
returned  are  significantly  different. 

Next,  the  appropriateness  of  the  Viability-Willingness  model  was  assessed  using 
SmartPLS  2.0.  SmartPLS  is  a  structural  equation-modeling  tool  based  on  Partial  Least 
Squares  (PLS).  PLS  has  an  advantage  over  traditional  statistical  techniques  since  it  is 
able  to  concurrently  test  the  measurement  and  structural  models  without  being  covariance 
based.  Additionally,  PLS  is  not  constrained  to  data  sets  that  meet  homogeneity  and 
normality  requirements  (Chin  et  ah,  2003).  A  significant  advantage  of  PLS  is  that  it  can 
handle  smaller  sample  sizes  relative  to  other  structural  techniques.  These  inherent 
strengths  make  PLS  a  highly  appropriate  approach  to  analyzing  the  data  set. 

Using  SmartPLS  version  2.0  (Ringle,  Wende  &  Will,  2005),  the  model  was 
evaluated  to  assess  the  measurement  model  and  the  structural  paths  between  the 
constructs.  To  obtain  reliable  results  and  t-values,  200  random  samples  of  83  were 
generated  using  a  bootstrap  procedure.  Finally,  the  hypotheses  were  evaluated  by 
assessing  the  sign  and  significance  of  the  structural  path  coefficients  using  two-tailed  t- 
test  statistics.  Since  SmartPLS  does  not  calculate  goodness-of-fit  statistics.  values 
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were  evaluated  to  assess  the  ability  of  various  proposed  relationships  to  predict  a 
significant  degree  of  explanatory  power  in  each  construct  and  t-values  were  evaluated  to 
determine  the  strength  of  the  various  paths  (Schuessler,  2009). 

Instrument  Validation 

The  validation  process  started  by  constructing  a  PLS  model  where  the  individual 
survey  questions  were  assessed  to  determine  how  well  they  measured  their  associated 
construct.  First,  the  internal  consistency  (reliability)  statistics  were  examined.  Reliability 
tests  determine  if  the  set  of  variables  are  consistent  with  the  intended  item  being 
measured.  All  reliability  measures  meet  the  acceptable  lower  limits  of  .70,  and  one 
exceeds  the  lower  limit  of  .60  (see  table  2)  for  a  newly  defined  scale  (Hair  et  al.,  2006). 

Next,  the  survey  items  are  assessed  for  construct  validity  by  performing  a  factor 
analysis  of  each  item  in  the  survey  and  calculating  the  reliability  of  the  resulting  factors. 
According  to  Hair  et  al.  (2006),  item  loadings  of  .5  or  greater  represent  items  of  practical 
significance.  After  removing  any  items  that  that  fail  reach  .5  on  any  factor,  it  was 
determined  if  the  items  for  each  construct  loaded  higher  on  their  own  construct  than  on 
other  constructs.  All  survey  items  loaded  above  the  threshold  (see  table  3)  and  were  kept 
for  the  remaining  analysis. 

Finally,  determining  discriminant  validity  requires  testing  the  average  variance 
shared  between  a  construct  and  its  measures  (AVE)  (Gefen  et  al.,  2000).  The  average 
variance  shared  between  the  constructs  and  their  measures  should  be  greater  than  the 
benchmark  of  .5  (Fomell  and  Larcker,  1981)  and  greater  than  the  corresponding 
correlations  between  constructs  themselves  (see  table  4).  The  matrix  supports  the 
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discriminant  validity  of  our  scales  in  that  the  elements  in  the  matrix  diagonal  are  higher 
than  .5  in  all  cases,  and  higher  than  the  off-diagonal  correlations  between  the  elements  in 
their  eorresponding  row  and  eolumn.  Therefore,  the  variables  and  the  eonstruets  pass  the 
tests  for  reliability  and  validity  as  noted  in  chapter  4. 

Chapter  Summary 

This  ehapter  outlined  the  methodology  of  this  researeh  demonstrating  one  way  to 
analyze  survey  samples.  By  adapting  the  FVM  to  a  Viability-Willingness  model,  we  are 
attempting  to  determine  the  pereeived  viability  and  the  pereeived  willingness  to 
implement  eloud  eomputing  in  the  Department  of  Defense. 
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IV,  Analysis  and  Discussion 


Chapter  Overview 

This  chapter  presents  the  results  from  the  survey  and  the  tests  of  the  model 
proposed  in  Chapter  2.  First,  the  results  from  the  eloud  eomputing  survey  of  DoD  IT 
personnel  are  eompared  with  the  survey  results  from  the  International  Data  Corporation 
Enterprise  Panel,  2009  Survey  on  Cloud  Serviees.  Sinee  government  and  commereial 
industries  have  different  eustomers,  stakeholders,  and  goals  driven  by  the  nature  of  the 
two  industries,  a  eomparison  of  the  question  regarding  the  issues  assoeiated  with  eloud 
eomputing  is  used.  The  seeond  part  of  this  ehapter  presents  the  results  of  the  analysis  of 
the  Viability-Willingness  Model  using  SmartPLS. 

Comparative  Analysis:  Commercial  and  government  sectors 

International  Data  Corporation  eonducted  a  survey  of  its  eommereial  enterprise 
panel  in  2009  on  the  top  ehallenges  and  issues  of  eloud  eomputing.  Two-hundred  sixty- 
three  IT  executives/CIOs  and  their  line-of-business  eolleagues  eompleted  the  survey 
about  their  eompanies’  use  of,  and  views  about,  IT  Cloud  Serviees.  As  part  of  the  survey, 
the  respondents  were  asked  to  rate  the  challenges/issues  aseribed  to  the  cloud/on-demand 
model  (Figure  10).  The  Y-axis  is  the  eoneerns  with  eloud  eomputing,  while  the  X-axis  is 
the  number  of  personnel  that  stated  the  eoneern  was  signifieant.  The  survey  used  a  5- 
point  Likert  seale  ranging  from  l=Not  Signifioant/Coneemed  to  5=Very 
Significant/Coneerned. 
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The  top  three  issues  for  the  eommereial  industry  as  noted  from  the  IDC  survey 
were  security,  availability,  and  performance  (Figure  10).  These  issues  were  also  rated  as 
the  most  significant  in  2008.  IDC  explains  this  as  a  call  for  better  service  level  assurance. 
The  number  four  issue  in  the  survey  was  a  concern  that  cloud  computing  might  cost  more 
than  current  computing  models.  This  perception  seems  to  contradict  what  proponents  of 
the  cloud  model  tout,  which  is  that  implementing  cloud  computing  leads  to  cost  savings 
(Kundra,  2010).  The  issue  of  bringing  the  data  or  services  back  in  house  was  rated  as  the 
fifth  most  important.  That  is,  the  survey  respondents  were  concerned  that  if  the  cloud 
computing  model  did  not  work,  it  would  be  more  difficult  to  move  the  services  back 
under  the  organization’s  control.  The  last  two  issues  that  the  survey  members  stated  were 
an  issue  was  the  ability  to  integrate  with  in-house  services  and  the  ability  to  customize 
the  service  to  what  is  needed.  These  are  important  since  they  both  convey  the  amount  of 
organizational  control  over  their  data  and  services. 

The  IDC  Enterprise  panel  survey  from  2009  shows  that  there  are  still  major 
concerns  about  cloud  computing.  While  it  was  expected  to  find  that  security, 
performance  and  availability  were  issues  with  a  majority  of  the  respondents;  on-demand 
costs  and  the  ability  to  bring  the  services  back  in  house  were  not.  There  is  still 
uncertainty  about  the  overall  cost  of  cloud  computing  and  whether  it  will  be  a  success  as 
a  computing  platform  for  organizations. 
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Figure  10,  IDC  Commercial  Enterprise  Panel  3Q09  Survey  Results 


For  comparison  to  the  IDC  Commercial  Enterprise  Panel  survey,  the  2010-2011 
cloud  computing  in  the  military  survey  done  in  this  research  sampled  DoD  IT  personnel 
(n=83)  on  the  same  issues  of  cloud  computing.  On  the  military  IT  survey,  the 
respondents  rated  the  challenges/issues  ascribed  to  the  cloud/on-demand  model  (Figure 
11).  The  Y-axis  is  the  concerns  with  cloud  computing,  while  the  X-axis  is  the  number  of 
personnel  that  stated  the  concern  was  significant.  Both  surveys  used  a  5-point  Likert 
scale  ranging  from  l=Not  Significant  to  5=Extremely  Significant.  Following  the  IDC’s 
method,  the  results  were  taken  from  the  respondents  that  selected  3,  4,  or  5  and  measured 
in  percentages.  For  an  accurate  comparison  of  commercial  and  government  industries, 
scales  and  questions  were  maintained  for  data  integrity. 
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■  DoD  IT  Personnel 


Figure  11,  Military  IT  Personnel  Survey  Results 


A  comparison  of  the  results  of  the  question  of  rate  the  challenges/issues  ascribed 
to  the  cloud/on-demand  model  shows  similarities  and  differences  between  the  two 
samples  (Figure  12).  The  results  are  taken,  and  measured  in  pereentage  of  the 
respondents  that  selected  3,  4,  or  5. 


■  DoD  IT  Personnel 

■  IDC  Enterprise  Panel 


Figure  12,  Comparison  of  Survey  Results 
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Availability. 

Availability  is  the  first  issue  compared  between  the  two  surveys.  Availability  is 
the  state  of  being  able  to  ensure  users  can  use  any  information  resource  when  ever  and 
whenever  it  is  needed.  There  is  a  significant  difference  (Z  =  3.464)  between  the  numbers 
of  military  IT  personnel  (98.8%)  that  rated  Availability  as  a  significant  issue  compared  to 
the  number  of  IDC  Enterprise  personnel  (82.9%).  Availability  depends  on  the 
accessibility  of  the  data,  the  system,  the  applications  and  the  infrastructure  used  to  access 
that  data.  The  loss  of  availability  is  critical  if  there  is  a  serious  incident,  network  failure, 
or  natural  disaster.  The  difference  between  the  two  surveys  for  availability  is  significant. 
For  the  military  IT  personnel,  the  availability  of  the  data  and  services  could  be  critical  to 
the  completion  of  mission  in  a  combat  zone.  For  example,  the  Army  mission  is  to 
provide  to  combatant  commanders  the  forces  and  capabilities  necessary  to  execute  the 
National  Security,  National  Defense,  and  National  Military  Strategies.  The  Army’s 
Signal  Corps  supports  this  mission  by  providing  and  managing  communications  and 
information  systems  support  for  the  command  and  control  of  combined  arms  forces.  The 
lack  of  availability  of  the  network,  data,  or  information  systems  could  affect  the  mission. 
The  commercial  industry  does  not  have  the  same  mission  as  the  Department  of  Defense. 
Where  loss  of  availability  would  impact  the  commercial  organization  in  terms  of  time 
and  profit,  it  might  not  affect  National  Security,  which  would  be  a  reason  for  the 
significant  difference  in  the  number  of  personnel  that  annotated  availability  as  a 
significant  concern. 
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Performance, 


The  next  issue  selected  as  significant  was  performance.  Cloud  computing 
performance  can  either  be  client-oriented  or  cloud-oriented  (Linthicum,  2010).  Client- 
oriented  performance  is  where  users  constantly  interact  with  the  cloud  provider  where 
there  is  latency  with  the  constant  back-end  machine-to-machine  communications  that 
occurs  between  the  SaaS  provider  and  the  browser.  Cloud-oriented  performance  is  where 
the  processing  occurs  in  the  “cloud”  and  is  compared  to  the  performance  of  completing 
the  processing  on-premise.  There  is  a  significant  difference  (Z  =  2.553)  between  the 
numbers  of  military  IT  personnel  (95.2%)  that  rated  Performance  as  a  significant  issue 
compared  to  the  number  of  IDC  Enterprise  personnel  (83.3%).  While  it  was  not  defined 
as  whether  performance  was  client-oriented  or  cloud-oriented  performance,  more  military 
IT  personnel  thought  performance  was  an  issue.  Client  oriented  performance  issues  may 
not  be  as  noticeable  in  terms  of  latency  unless  there  is  network  saturation  (Linthicum, 
2010).  Whereas  cloud-oriented  performance  can  be  an  advantage,  performing  large 
amounts  of  processor  intensive  calculations  or  queries  can  take  many  hours  on  the  local 
network.  The  scalable  nature  of  the  cloud  allows  additional  processors  to  be  quickly 
added  resulting  in  calculation  or  queries  taking  minutes  to  complete.  Commercial 
industry  has  more  experience  with  cloud  computing  and  a  lower  number  of  the  IDC 
Enterprise  panel  survey  respondents  stated  that  performance  is  an  issue.  Eor  DoD  IT 
personnel,  latency  on  a  bandwidth  constricted  tactical  network  is  not  acceptable  and 
therefore  more  survey  respondents  would  rate  this  as  an  issue. 


55 


Security. 

While  respondents  from  both  surveys  feel  that  seeurity  is  a  signifieant  issue  in 
itself,  there  was  no  differenee  (Z  =  0.537)  between  the  numbers  of  DoD  IT  personnel 
(90.4%)  and  the  IDC  Enterprise  sample  (87.5%).  While  seeurity  was  not  explieitly 
defined  in  either  survey,  as  stated  in  ehapter  2,  FISMA  defines  three  seeurity  objeetives 
for  information  and  information  systems  that  serve  as  the  basis  for  NIST’s  analysis: 
Confidentiality,  Integrity,  and  Availability.  In  both  surveys,  the  respondents  thought 
seeurity  was  a  signifieant  issue.  Seeurity  of  the  eloud  serviee,  whether  proteeting  mission 
essential  data  or  serviees  for  the  military  or  proteeting  the  seeurity  of  the  eustomers’  data 
and  information  for  the  eommereial  seetor,  is  important  for  their  organization.  Losing  the 
seeurity  of  data  or  information  in  the  eloud  for  government  or  eommereial  industries  ean 
have  severe  eonsequenees.  The  seeurity  of  the  eloud  may  provide  a  roadbloek  on  its 
implementation. 

Integrate  with  in-house  IT. 

The  ability  to  integrate  eloud  eomputing  offerings  and  serviees  with  in-house  IT  is 
the  next  issue  eompared  between  the  two  surveys.  There  is  not  a  significant  difference  (Z 
=  1.009)  between  the  numbers  of  military  IT  personnel  (83.1%)  that  rated  the  ability  to 
integrate  with  in-house  IT  as  a  significant  issue  compared  to  the  IDC  Enterprise 
personnel  (76.8%).  Organizations  that  use  cloud  computing  want  to  maximize  the 
control  of  their  business  core  systems,  which  can  be  in-house  legacy  systems  and 
integrate  these  systems  across  externally  sourced  cloud  services  (Gens,  2008). 

Both  government  and  commercial  industry  can  feel  this  integration  between  in- 
house  and  cloud  computing  systems  is  more  of  an  issue.  The  military  has  a  large  number 
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of  program-managed  systems  that  perform  specific  functions.  For  example,  the  Army 
uses  a  number  or  Army  Battlefield  Command  Systems  (ABCS)  that  provide  specific 
services  for  the  commander  and  integration  with  these  systems  might  prove  to  be 
difficult.  In  the  commercial  industry,  an  organization’s  inventory  management  systems 
could  be  core  business  systems  that  is  proprietary  and  could  be  difficult  to  integrate  with 
cloud  services.  In  both  cases,  these  systems  could  be  more  difficult  to  integrate  with 
other  systems  that  use  cloud  services. 

Ability  to  customize  services. 

Next,  the  number  of  personnel  stating  that  the  ability  to  customize  software  and 
applications  is  a  significant  issue  is  compared  between  the  two  surveys.  There  was  no 
difference  (Z  =  0.223)  between  the  numbers  of  military  IT  personnel  (73.5%)  that  rated 
the  ability  to  customize  services  as  a  significant  issue  compared  to  the  IDC  Enterprise 
personnel  (76.0%).  One  of  the  advantages  of  cloud  computing  is  the  ability  to  quickly 
customize  software,  platforms  and  cloud  infrastructures.  Organizations  want  to 
customize  “off-the-shelf’  cloud  services  and  tailor  these  services  to  the  needs  of  their 
businesses  (Gens,  2008).  It  is  plausible  that  the  need  for  better  fitting  services  drove  a 
large  number  of  respondents  in  both  surveys  to  report  customization  as  an  issue  with 
cloud  computing. 

On-demand  costs. 

On-demand  cost  is  the  next  issue  in  the  survey.  On-demand  costs  are  costs 
incurred  when  using  cloud  computing  in  the  organization.  There  is  a  significant 
difference  (Z  =  2.878)  between  the  numbers  of  military  IT  personnel  (65.1%)  that  rated 
On-demand  costs  as  a  significant  issue  compared  to  the  IDC  Enterprise  sample  (81.0%). 
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The  on-demand  cost  issue  may  seem  to  contradict  the  reason  for  moving  to  a  cloud 
computing  technology,  given  that  cost  savings  are  purported  to  be  a  benefit.  One  reason 
behind  this  discrepancy  is  organizations  fear  that  employees  may  use  the  service  more 
than  what  is  budgeted.  Commercial  industry  is  conscious  of  what  they  spend  and  of  their 
profits,  where  the  government  sector  does  not  necessarily  see  the  bottom  line,  but  they 
work  within  budgets.  The  difference  in  the  number  of  respondents  stating  on-demand 
costs  is  an  issue  between  the  two  samples  is  expected.  The  commercial  industry  has 
more  experience  in  implementing  cloud  computing,  therefore  they  may  see  on-demand 
costs  exceed  their  initial  expectations  whereas  the  government  sector  is  just  beginning  to 
implement  cloud  services.  Cloud  computing  can  allow  their  organization  to  save  money 
on  infrastructure  (Del  Nibletto,  2010),  IT  staffing  and  maintenance  costs  (Kundra,  2010). 
If  on-demand  costs  start  to  exceed  the  previous  budget  for  the  same  type  of  services,  then 
the  cloud  computing  service  model  would  become  an  issue. 

Bringing  IT  services  back  in-house. 

Bringing  IT  services  back  in-house  is  the  last  issue  compared  between  the  two 
surveys.  There  is  a  significant  difference  (Z  =  4.202)  between  the  numbers  of  military  IT 
personnel  (56.6%)  that  rated  bringing  IT  services  back  in-house  as  a  significant  issue 
compared  to  the  IDC  Enterprise  personnel  (79.8%).  Organizations  wonder  whether  using 
cloud  services  will  lead  to  the  same  type  of  proprietary  services  that  are  dealt  with  today. 
Proprietary  services  and  software  make  it  difficult  to  move  services  back  in-house  if  they 
are  not  satisfied  with  the  cloud  (Gens,  2009).  Military  IT  personnel  either  do  not  think 
they  will  move  to  cloud  computing  or  only  move  limited  services  to  the  cloud  and  leave 
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core  processes  in-house.  Therefore,  there  would  be  less  military  IT  personnel  that 
thought  this  was  an  issue  compared  to  their  civilian  counterparts. 

Summary. 

The  comparative  analysis  of  the  IDC  Enterprise  panel  2009  IT  Cloud  Services 
Survey  and  the  2010-201 1  military  IT  personnel  cloud  computing  in  the  military  survey 
had  interesting  results.  More  military  IT  personnel  cited  availability,  performance  and  in- 
house  integration  as  significant  issues  than  did  personnel  on  the  IDC  Enterprise  panel. 
There  was  also  a  significant  difference  between  the  number  of  IDC  Enterprise  panel 
personnel  citing  on-demand  costs  and  bringing  the  IT  services  back  in-house  as  concerns 
than  the  number  of  personnel  in  the  military  IT  survey.  Cost  may  be  expected  to  be  more 
important  to  commercial  industry  than  the  government  sector,  but  cloud  computing  costs 
are  supposed  to  be  lower  than  current  computing  methods  and  technologies.  Conversely, 
there  was  no  difference  in  the  number  of  respondents  that  rated  security  as  a  significant 
issue,  nor  was  there  a  difference  in  the  number  of  respondents  who  saw  the  ability  to 
customize  software  as  a  major  issue.  Interestingly,  stating  that  on-demand  costs  are  a 
significant  issue  goes  against  the  reasons  for  implementing  cloud  computing.  Bringing 
services  back  in-house  could  be  an  issue  if  the  cloud  computing  model  does  not  work. 
Since  more  than  79%  of  the  commercial  industry  survey  respondents  rate  this  as  an  issue, 
it  could  mean  there  is  a  lack  of  confidence  in  the  long  term  viability  of  the  cloud 
computing  model. 

The  survey  comparison  looked  at  the  issues  and  concerns  with  cloud  computing. 
These  issues  are  part  of  the  viability  of  cloud  computing.  The  needs  of  the  organization 
are  considered  when  determining  if  the  new  information  technology,  or  cloud  computing. 
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is  a  viable  technology.  As  noted  above,  there  are  ideas  in  the  military  about  cloud 
computing,  which  directly  affect  the  perceived  viability  and  perceived  willingness  to 
implement  the  technology. 

The  remainder  of  the  data  in  the  military  IT  cloud  computing  survey  was  used  to 
examine  the  perceived  viability  and  its  relationship  with  the  willingness  of  IT  personnel 
to  implement  cloud  computing  in  the  military.  The  following  section  examines  the 
relationship  between  the  perceived  system  viability  and  perceived  willingness  to 
implement  cloud  computing. 

Discriminant  Validity  and  Reliability 

The  Viability-Willingness  Model  for  cloud  computing  looks  at  the  relationship 
between  the  perceived  viability  and  perceived  willingness.  In  the  VWM,  perceived 
viability  is  directly  determined  by  cost,  organizational  inertia  and  fit.  Viability  and  cost 
determine  organizational  willingness  to  implement.  To  test  the  model  and  its  constructs, 
the  validity  and  reliability  must  first  be  tested. 

Discriminant  validity  and  reliability  of  the  constructs  were  tested  using  Conbach’s 
Alpha,  as  recommended  by  Hair  et  al.  (2006).  Reliability  tests  determine  if  the  set  of 
variables  are  consistent  with  the  intended  item  being  measured.  The  internal  consistency 
(reliability)  statistics  using  PLS  results  were:  .691  for  Fit;  .845  for  Inertia;  .785  for 
Viability;  and  .904  for  Willingness  (Table  2).  The  reliability  thresholds  for  Inertia, 
Viability  and  Willingness  meet  the  acceptable  lower  limits  of  .70,  while  Fit  exceeds  the 
lower  limit  of  .60  for  a  newly  defined  scale  (Hair  et  ah,  2006). 
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Table  2,  Reliability  Statistics 


Cronbach's  Alpha 

Fit 

0.691957 

Inertia 

0.845359 

Viability 

0.785395 

Willingness 

0.904545 

Next,  the  convergent  validity  was  determined  by  examining  whether  all  items 
loaded  highly  on  their  respective  construct  on  PLS.  A  common  rule  of  thumb  is  a 
loading  greater  than  .70  (Yoo  and  Alavi,  2001).  In  the  Viability-Willingness  Model,  all 
items  loaded  on  their  respective  constructs  from  .783  to  .899  (Table  3).  All  values  lower 
than  .40  were  removed  for  easier  interpretation. 
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Table  3,  Convergent  Validity 


Cost 

Fit 

Inertia 

Viability 

Willingness 

COSTl 

I 

FITl 

0.852295 

FIT2 

0.894746 

INERTIA  Ir 

0.827469 

INERTIA2r 

0.858527 

INERTIASr 

0.8III24 

INERTIA4r 

0.783988 

VIABILITYI 

0.804765 

VIABILITY2 

0.871319 

VIABILITY3 

0.829887 

WILLI 

0.867694 

WILL2 

0.876659 

WILLS 

0.899804 

WILL4 

0.882597 

In  the  cost  construct,  COST2  and  COSTS  did  not  load  on  the  Cost  construct  and 
were  removed  from  the  model.  Additionally  FITS,  FIT4,  FITS,  FIT6,  WILLS,  WILL6, 
WILL7,  and  WILLS  did  not  load  on  adequately  on  their  construct  and  were  therefore 
removed  from  the  model. 

Determining  discriminant  validity  requires  testing  the  average  variance  shared 
between  a  construct  and  its  measures  (AVE)  (Gefen  et  ah,  2000).  Table  4  presents  the 
AVE  matrices  and  construct  correlations  for  the  model.  The  matrix  supports  the 
discriminant  validity  of  our  scales  in  that  the  elements  in  the  matrix  diagonal  (AVE 
results  are  bold)  are  higher  in  all  cases  than  the  off-diagonal  elements  in  their 
corresponding  row  and  column.  Each  construct  AVE  should  be  higher  than  the 
benchmark  of  .60  as  recommended  by  Fornell  and  Larcker  (1981).  In  addition,  the  AVE 
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must  be  larger  than  its  eorrelation  with  other  eonstruct,  and  each  time  should  load  more 
highly  on  its  assigned  construct  than  other  constructs  (Gefen,  2000). 

Table  4,  Discriminant  Validity 


Cost 

Fit 

Inertia 

Viability 

Willingness 

Cost 

1 

Fit 

-0.264952 

0.7634 

Inertia 

-0.175177 

0.150387 

0.6735 

Viability 

-0.289511 

0.601101 

-0.208698 

0.6985 

Willingness 

-0.264672 

0.396132 

-0.02597 

0.495498 

0.7775 

Results 

After  assessing  discriminant  reliability  and  validity,  the  model  is  then  processed 
using  SmartPLS.  The  results  are  depicted  in  Figure  13.  All  hypothesized  relationships 
except  for  one  were  supported.  Path  significance  was  estimated  using  a  bootstrapping 
procedure  with  200  resamples,  which  tends  to  provide  reasonable  standard  error  estimates 
(Mathieson,  et  al.,  2001;  Ravichandran  and  Rai,  2000).  There  was  not  a  significant  direct 
affect  of  Cost  on  Willingness  (-0.132  n.s.),  which  means  that  cost  was  not  directly  related 
to  Willingness  (HI).  There  was  a  significant  direct  effect  of  Cost  on  Viability  (-0.188*), 
which  supported  H2;  Cost  is  negatively  related  to  Viability.  Hypothesis  3  theorized  that 
Inertia  is  negatively  related  to  and  has  a  direct  effect  on  Viability.  PLS  showed  that 
Inertia  had  a  significant  affect  Viability  (0-0.332*),  supporting  H3.  H4  hypothesized  that 
Fit  would  be  positively  related  to  Viability.  H4  was  supported  in  that  Fit  had  a 
significant  direct  affect  on  Viability  (0.601  *).  Lastly,  H5  stated  that  Viability  was 
positively  related  to  Willingness.  Viability  had  a  significant  direct  affect  on  Willingness 
(0.457*)  and  therefore  supported  H5. 
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Cost 


HI  (-0.132,  n.s) 


H2  (-0.188*) 


H=.485 


Willingness 

H=.262 


Fit 


H4  (0.601*) 


Path  coefficients  are  reported 
*=significant  at  the  .05  level 


Figure  13,  Viability-Willingness  Model  Structural  Results 


The  Viability-Willingness  Model  explained  48.5%  of  the  varianee  for  viability 
perceptions  and  26.2%  of  the  variance  for  the  perceived  willingness  to  implement  cloud 
computing.  The  model  measures  whether  cost,  inertia,  and  fit  are  significant  predictors 
of  viability.  Viability  of  cloud  computing  is  partially  formed  by  cost,  organizational 
inertia  and  the  fit  of  the  technology  with  the  needs  of  the  organization.  Willingness  is 
only  partially  predicted  by  the  viability  of  cloud  computing.  Performance,  availability 
and  security  might  be  significant  factors  in  predicting  viability  since  over  90%  of  military 
IT  personnel  respondents  cited  those  issues  as  significant. 

The  other,  unmeasured,  perceived  attributes  of  cloud  computing  could  also  have  a 
direct  affect  on  the  perceived  willingness  to  implement  it.  While  viability  contributed  to 
26%  of  the  variance  explained,  the  attitude  towards  cloud  computing  might  be  more  of  a 
factor  than  whether  the  technology  is  viable  for  the  organization.  All  questions  on  the 
issues  of  cloud  computing  were  selected  by  more  than  50%  of  the  respondents  in  the 
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military  IT  cloud  computing  survey  as  being  signifieant.  The  pereeption  that  eloud 
eomputing  has  multiple  signifieant  issues  reduees  the  willingness  to  implement  the 
teehnology.  Therefore,  just  beeause  eloud  eomputing  is  viable  for  an  organization  does 
not  mean  there  is  going  to  be  a  willingness  towards  implementation;  nonetheless  it  is  a 
major  faetor. 

Chapter  Summary 

The  eolleeted  data  from  the  2010-2011  Cloud  Computing  in  the  Military  survey 
suggests  that  eost,  inertia,  and  fit  were  signifieant  in  predieting  viability;  additional 
modifieations  to  the  survey  instrument  would  inerease  the  explained  varianee  at  the  eost 
of  the  parsimony  of  the  instrument.  This  modifieation  would  also  inerease  varianee 
explained  in  willingness,  although  adjusting  the  survey  to  inelude  personality  and  attitude 
might  also  signifieantly  increase  the  pereeived  willingness. 


65 


V.  Conclusions  and  Recommendations 


Chapter  Overview 

This  chapter  reviews  the  two  researeh  questions  and  presents  the  conclusion  of 
this  study.  Sections  discussing  research  limitations,  follow-on  research,  and 
recommendations  for  future  research  follow  this  section.  In  the  general  eonelusion,  the 
benefits  of  this  research  are  highlighted. 

Research  questions  and  Conclusions 

This  research  was  an  exploratory  examination  of  the  opinions  military  IT 
personnel  of  cloud  computing  in  the  in  the  Department  of  Defense  and  the  Army.  Its 
research  was  motivated  by  desire  to  understand  two  overall  research  questions: 

(1)  Is  cloud  computing  perceived  as  a  viable  technology  in  the  DoD/Army? 

(2)  Is  there  a  perceived  willingness  to  implement  cloud  computing  in  the 
DoD/Army? 

The  research  provided  an  understanding  whether  military  IT  personnel  perceive 
cloud  computing  as  a  viable  technology  for  their  organization  as  well  as  the  connection 
between  the  perceived  viability  of  new  technologies  and  the  willingness  of  IT  personnel 
to  implement  them. 
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A  Difference  Between  Government  and  Commercial  Industry. 

A  comparative  analysis  between  IDC  Enterprise  Panel  personnel  and  military  IT 
personnel  demonstrated  several  differenees  between  eommereial  and  government  seetors. 
Availability,  performanee,  and  integration  with  in-house  IT  were  identified  by  a  higher 
pereentage  of  military  IT  personnel  as  signifieant  issues  than  the  IDC  Enterprise  panel. 
Security  and  the  ability  to  customize  had  the  same  signifieanee  between  the  two  groups, 
while  the  IDC  Enterprise  panel  rated  on-demand  eosts  and  bringing  the  IT  serviees  baek 
in  house  as  more  of  an  issue  than  did  military  IT  personnel.  The  military  IT  personnel 
appear  more  worried  about  availability,  performanee  and  integrating  with  in-house  IT 
systems  and  less  eoncerned  with  eloud  eomputing  eosts  and  the  ability  to  bring  serviees 
baek  in-house  at  a  later  date. 

Perceived  Viability  of  Cloud  Computing. 

The  Viability-Willingness  Model  was  an  exploratory  model  designed  to 
understand  the  interaetion  of  the  pereeived  viability  of  eloud  eomputing  and  the 
willingness  to  use  it.  While  the  model  measured  48.5%  of  the  varianee  in  the  viability  of 
eloud  eomputing,  there  are  other  faetors  diseovered  in  the  survey  that  might  also  prediet 
the  viability  of  eloud  eomputing.  The  VWM  demonstrated  that  cost,  inertia  and  fit  play  a 
role  in  the  determining  the  viability  of  eloud  eomputing. 

Perceived  Willingness  to  Implement  Cloud  Computing. 

Perceived  willingness  to  implement  cloud  computing  can  be  more  of  an  attitude 
towards  cloud  computing.  The  VWM  examined  viability  and  cost  as  measures  that 
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would  have  a  direct  affect  on  the  perceived  willingness  to  implement.  The  variance 
explained  was  26.2%,  which  indicates  other  measures  would  also  have  a  direct  affect  on 
the  perceived  willingness.  Other  measures  that  could  affect  the  willingness  to  implement 
cloud  computing  include  personality  traits  (Chambers  et  ah,  2003),  attitudes  towards  the 
technology  (Werner,  2004),  and  actual  task  situations  that  would  affect  the  relative 
importance  of  the  perceived  attributes  of  the  technology  (Turner,  Thomas,  and  Reinsch, 
2004).  Successful  implementation  of  a  new  technology  (cloud  computing)  could  partially 
depend  on  the  willingness  to  make  the  changes  necessary  to  make  the  technology  work. 

Limitations 

There  are  several  limitations  to  this  research.  The  sample  size  (n=83)  was  large 
enough  to  perform  the  needed  analysis.  However,  a  larger  sample  might  allow  for 
additional  statistically  robust  analysis,  which  may  lead  to  an  increased  accuracy  of  the 
inferences  about  the  population,  and  refined  detection  of  effects  in  the  model.  A  broader 
sample  will  expand  the  available  tools  used  for  analysis  to  include  covariance-based 
analysis.  Expanding  the  sample  demographic  to  include  additional  IT  personnel  more 
evenly  across  the  Department  of  Defense  and  the  Federal  government  would  allow  for 
additional  analysis.  By  increasing  the  sample  frame  to  include  every  member  of  the  DoD 
IT  community  from  which  the  sample  is  taken  increases  the  randomness  of  the  survey 
and  reduces  any  biases  in  the  sample. 

The  survey  instrument  had  limitations.  As  an  exploratory  study,  some  items  did 
not  initially  load  properly  and  therefore  were  not  included  in  the  analysis.  This  might 
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have  occurred  due  to  a  misunderstanding  of  words  in  the  question  or  the  question  itself 
It  can  also  happen  if  the  questions  of  the  survey  measured  something  other  than  the  intent 
of  the  construct.  One  set  of  questions  was  previously  validated  and  two  others  loaded 
properly  on  their  respective  constructs.  Using  previously  validated  questions  or  survey 
instrument  can  lead  to  an  increase  of  rigor,  an  increase  of  data  quality  and  prevent 
inaccurate  conclusions.  The  wrong  instrument  of  questions  could  increase  the  error  in  the 
model  and  analysis. 

Recommendations  for  Future  Research 

This  research  provided  a  starting  point  on  determining  the  perceived  viability  and 
perceived  willingness  to  implement  cloud  computing  in  the  military.  Follow  on  research 
should  include  increasing  the  sample  frame  and  sample  size  to  further  validate  this  study. 
Other  areas  for  research  should  include  perception  differences  among  armed  services, 
different  IT  skill  sets,  and  duty  positions.  Furthermore,  additional  research  into  the  top 
issues  of  cloud  computing  would  be  valuable  in  determining  why  those  issues  are  thought 
to  be  so  significant.  Additional  research  is  also  needed  to  clarify  the  relationship  between 
viability  and  willingness.  This  research  highlighted  that  a  technology  can  be  a  viable  in 
the  organization,  yet  the  organization  still  won’t  implement  it.  Additional  research 
should  be  conducted  on  why  an  organization  is  not  willing  to  implement  a  technology  it 
sees  as  viable.  Further  analysis  is  also  needed  on  the  difference  between  government  and 
commercial  industry  and  the  possible  implications  of  implementing  a  new  information 
technology. 
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The  VWM  can  be  refined  through  additional  research  to  increase  the  variance 
determined  in  viability  and  willingness.  A  redesign  of  the  cost  construct  by  adding  more 
dimensions  would  help  to  see  if  a  multidimensional  construct  plays  a  greater  role  in  the 
viability  and  willingness  to  implement  a  new  technology.  There  may  be  specific  parts  of 
the  cost  of  implementation  that  affect  viability  and  willingness  differently.  The 
willingness  construct  should  be  examined  for  the  influence  of  personality  characteristics, 
attitudes  toward  the  new  technology  and  possibly  positive  and  negative  affect.  A  more 
in-depth  study  examining  the  perceptions  of  the  different  types  of  deployment  cloud 
models  would  provide  the  framework  that  organizations  could  use  in  examining  the 
viability  and  willingness  to  implement  the  latest  technology  trends. 

Conclusion 

Overall,  findings  suggest  that  cloud  computing  may  be  a  viable  option  for  the 
Department  of  Defense,  but  willingness  to  implement  cloud  computing  is  not  the  same  as 
viability.  This  research  indicates  that  simply  because  a  technology  has  the  potential  to 
improve  an  organization,  it  still  may  not  be  implemented.  This  thesis  defined  criteria  for 
measuring  the  viability  and  willingness  to  implement  cloud  computing.  Viability  was 
affected  by  cost,  organization  inertia,  and  the  fit  of  the  technology  with  the  organization. 
Willingness  was  partially  determined  by  viability  perceptions,  which  supports  previous 
research  that  organizational  attitude  toward  the  technology  also  affects  the  willingness  to 
implement  a  new  technology. 
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Today,  the  federal  government  is  coneentrated  on  redueing  the  budget  defieit, 
while  completing  the  same  missions  and  functions  at  a  reduced  cost.  Whether  it  is 
freezing  pay  wages,  reducing  work  force,  reengineering  business  processes  or  improving 
efficiencies,  technology  can  be  used  as  an  enabler  for  working  smarter  and  more 
efficiently.  There  are  several  areas  discussed  in  the  thesis  that  demonstrated  the  ability  to 
use  cloud  computing  to  support  non-core  business  functions.  Different  commercial 
industries  use  cloud  computing  differently.  The  DoD  can  learn  from  other  government 
agencies  and  commercial  industries  in  ways  to  use  cloud  computing  to  reduce  costs, 
either  through  reduced  hardware  purchases,  reorganization  of  personnel  and  jobs,  or  by 
shifting  non-mission  essential  processes  to  a  cloud  provider  which  would  reduce 
personnel  needed  to  perform  those  functions.  This  research  showed  that  just  because 
cloud  computing  is  a  viable  alternative  to  the  current  desktop  computing  platform,  the 
organization  might  have  a  perception  that  cloud  computing  would  not  work.  This 
perception  could  hinder  how  quickly  cloud  computing  is  accepted  in  the  DoD. 
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Appendix  A:  SRB  Information 


DEPARTMENT  OF  THE  AIR  FORCE 
AIR  FORCE  INSTITUTE  OF  TECHNOLOGY 
WRIGHT-PATTERSON  AIR  FORCE  BASE  OHIO 


17  Nov  20 10 


MEMORANDUM  FOR  DR.  MICHAEL  GRIMAILA 


FROM:  .Alan  Hcmingcr,  Ph.D. 

AFT  T  1RI3  Research  Reviewer 
2950  Hobson  Way 

Wrighl-Patterson  APB.  OH  45433-7765 

SUBJECT:  .Approval  for  exemption  request  from  human  experimentation  requirements  (32  CFR 
219.  DoDD  3216.2  and  API  40-402)  for  study  titled  “Fit-viability  of  Cloud  Computing  in  the 
Department  of  Defense” 


1 .  't'our  request  was  based  on  the  Code  of  Federal  Regulations,  title  32,  part  219,  section  101, 
paragraph  (b)  (2)  Research  activities  that  involve  the  use  of  educational  tests  (cognitive, 
diagnostic,  aptitude,  achievement),  survey  procedures,  interview  procedures,  or  observation  of 
public  beha\  ior  unless:  (i)  Information  obtained  is  recorded  in  such  a  manner  that  human 
subjects  can  be  identilied.  directly  or  through  identifiers  linked  to  the  subjects;  and  (ii)  Any 
disclosure  of  the  human  subjects’  responses  outside  the  research  could  reasonably  place  the 
subjects  at  risk  of  criminal  or  civil  liability  or  be  damaging  to  the  subjects’  financial  standing, 
employability,  or  reputation. 

2.  \'our  study  qualifies  for  this  exemption  because  you  are  not  collecting  sensitive  data,  which 
could  reasonably  damage  the  subjects’  financial  standing,  employability,  or  reputation.  Further, 
the  demographic  data  you  arc  collecting  cannot  realistically  be  expected  to  map  a  given  response 
to  a  specific  subject. 


3.  This  determination  pertains  only  to  the  Federal,  Department  of  Defense,  and  Air  Force 
regulations  that  govern  the  use  of  human  subjects  in  research.  Further,  if  a  subject’s  future 
response  reasonably  places  them  at  risk  of  criminal  or  civil  liability  or  is  damaging  to  their 
financial  standing,  employability,  or  reputation,  you  are  required  to  file  an  adverse  event  report 
w  ith  this  office  immediately. 


/ 


ALAN  HEMINGER.  FH.D. 
AFIT  Research  Reviewer 


cc,  C  upt  Michael  Killaly 
C‘t)-iu\csiigatm' 

.ludiih  Copier.  Conlractor 

.‘M  i  l  Sponsored  Programs  Oftice 
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Appendix  B:  Survey  Instrument 


survey 


Fit-viability  of  Cloud  Computng  in  the  OoO 


Survey  meets  criteria  for  exclusion  for  a  SCN  under  32  CFR 
219,  DoDD  3216.2,  and  AFI  40-402 


Privacy  Notice 


The  following  information  is  provided  as  req aired  by  the  Privacy  Act  of  1974: 

Purpose:  The  puipose  of  this  survey' is  to  gain  abetter  understandii^  on  the  perception  of  implementing  Goud  Computing 
and  Thin  Client  Computing  in  flie  Department  of  Defense.  The  suri'eyis  designed  to  target  members  trf  the  Information 
Technology  commuti  win  the  Department  of  Defense  andd)eU.S.  Armylnfermation  Systems  Managers. 

This  sur%'eyis  intended  to  gather  opinions  of  the  Infoonatlon  Technology  community  regarding  the^jpropnaieness  and 
viability  of  doud  computing  and  tlin  cbent  computing.  Partiapationis  highly  encouraged  since  your  opinion  is  important. 
U‘e  wii  only  use  the  statistica!  results  for  our  research,  so  your  responses  are  completely  anonymous.  The  survwhasBO 
questions  and  should  take  10-1 5  minutes 

•There  are  also  three  sets  questions  addressing  the  25  Point  Implementation  Plan  to  Refonn  Federal  Information 
Technology  Management  dut  was  released  on9  December  2010.* 

Participation:  We  would  greatly  appredatc  your  partidpation  in  our  data  cdlectioneffiirt.  Yourpartidpatioois 
COMPLETELY  VOLUNTARY.  Your  decision  to  ret  participate  or  to  withdrawal  from  partidpation  will  not 
jeopardize  your  relationship  with  the  Air  Force  histitute  of  Technology,  theU.S.  AirForcs,  or  the  Department  of  Defense. 

Confldenriality:  We  ask  for  some  demographicinformation  in  order  to  interpret  results  more  accurately.  Only 
sumnrarized.  statistcally  e\-aluated  and  comfietely  anonymous  data  will  be  used  fa  publishing  purposes.  Eadi  participant 
will  have  an  opportunity  to  receive  the  processed  results. 


Instructions 


•  Base  your  answers  on  your  own  houghts  &  experiences 

•  Please  make  your  answers  dear  and  conase  when  asked  to  answer  in  a  response  or  when  pro\i  ding  comments 

•  Be  sure  to  select  the  correct  option  button  when  asked 


Contact  information : 


If  you  have  am'  questions  a  comments  about  tie  sur^'ey,  coiSactCPT  Michael  Killalr  at  foe  number,  fax,  mailing  address, 
or  e-mail  addresslisted  below'. 

AFIT/ENV  BLDG  fi40  /  Room  104A 
2950  Hobson  Way 

Wright-Patterson  AFB,  OH  45433-7765 
Email:  MichaeUKiBalv'^aflt.edu 
Adrisor:  vvvvTvw-TVTVTwg  afit.edu 
Phone:  DSN  785-3636x7395.  commercial  (937)  255-3636x7395 
Fax:  DSN  986-4699:  commercial  ^37)  656-4699 


Please  enter  your  email  address  bdow:  (The  email  address  is  used  to  create  a  unique  ED  to  ensure  daQ  integrity) 


*  E  mail  Address: 
Do  mu  want  statistical  results  from  this 


13%  complete 


NOTICE  &  CONSENT  BANNER: 

Useof  rte  DoD  comptaer  system,  caithortzed  or  unauthorized,  constitutes  consett  to  monitoring  of  this  system. 
Unauthorized  use  me^’  subject  you  to  criminal  prosecution.  Evidence  of  unauthorized  use  collected  during  moniiortng  nun 
be  used  for  administrative,  criminal,  or  other  adverse  action.  Useof  this  system  consi'ttutes  consent  to  monitoring  for  these 
purposes. 


Read  the  Privacy  and  Securin' Notice 
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Section  I:  Cloud  Computing 


Not  at  all  i  Not  Ven*  Fairh*  |  Very  Highly 

Cloud  Computing  knowledgeable  Knowledgeable  Knowledgeable  Knowledgeable  Knowledgeable 

1  ! 

2 

3  1 

4  1 

5 

j  How  knowledgeable  do  you  consider  yoursdf  i 

when  comes  to  cloud  conqiudng?  I; 

P 

Hmt  do  the  following  casks  align  with  cloud  computing  in  a  deployed 
oitironment? 

Not  at  all 
align 

Sligbth'  not 
align 

Neutral 

Slightly  align 

Closeh*  align 

1 

3 

5 

2  Accessing  mission  critical  data  or  services 

;Cr. 

O’ 

lO' 

S? 

2  Performing  Disaster  Recoveri*Continuit>*  of  Operations 

tasks 

’Q1 

O! 

■Qt 

jg 

How  do  the  fiillow  ing  tasks  align  with  cloud  computing  in  a  garrison 
«iv1ronment? 

Not  at  all  ' 
align  1 

Slighih*  not 
align 

Neutral 

Slightly  align 

Closeh*  align 

‘  i 

2 

4 

5  ' 

_|  Accessing  mission  essential  data  or  senices 


^i^Emmssr-r 


Performing  Disaster  Recover>'/ConCinuini'  of  Operations 
tasks 


Host  moch  do  you  agree  with  each  of  the  following? 

^  My  organization's  computing  task  requirements  closely 
align  widi  cloud  senices  on  a  prh  ate  cloud 
7  Current  applications  can  be  easily  adapted  to  the  cloud 


Cloud  Computing  Term 

Short  Term 

Maybe  Short 
Term 

..  -  Mavbe  Lone  ,  ^ 

Not  Sure  •  ^  Lone  Term 

Term 

2  3  4  5 

8 

Do  you  see  cloud  computing  as  a  short-term  &d  or  a  long¬ 
term  shift  in  computing  technologv  ? 

a  ,||  B 

Rate  the  Cballengestlssues  ascribed  to  the  cloud/on-demand  model? 

9  Securit}' 

10  Performance 

11  Availability 

12  Integration  with  in-house  IT 

13  Abilin*  to  cusMmize 

14  On-demand  costs 

15  Bringii^  backin-house 

16  Prohibitive  Regulatory  requirements 

17  Number  of  vendors  cnrrsitly  available 


Not  sommbat  .  ven*  Extremeh* 

.  .  --  agnmcant  . 

significant  sgnificant  significant  Significant 


38®  b  complete 
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Section  II:  Economic  Impact 


m 


Total  Cost  of  On'Dership  (TCO) 


Less 

Expen  si^e 


SUgbth’  Less 
Expen  sh'e 


Abont  the  slightK  more  .  More 
same  expensi\'e  arpensive 


Compared  to  desktop  computing,  the  Total  Cost  of 
On'uership  (TCO)  of  cloud  computing  is: 


Additional  IT  support  staff  training 


Hou  important  is  additional  IT  support  staff  training  to 


Not  Some^rhat  .  Verv 

I  _  Important  , 

Important  Important  Important 


implementing  cloud  computing? 


Extremeh' 

Important 


IT  Staff  reorganization 


No 

reorganization 


little  Some  A  great  deal  of 

not  sure 

reorganization  reorganuation  reorganization 


How  much  n  Staff  reorganization  is  needed  with  the 
adoption  of  clond  computing? 


C?' 


How  well  do  >r>H  agree  with  the  foUon  ing  statement? 


22^  The  cost  advantages  of  cloud  computing  outweigh  the 
potential  disad^antages 


Stronglv  „  NciAer  agree  . 

Disagree  ..  ^  Agree 

Disagree  nor  disagree 


Strongly 

Agree 

5 


o: 


50®o  ccanplete 
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Section  III:  Organization  Information 


How  well  do  >*00  agree  with  the  following  statements? 

1  Strongly 
Disagree 

Disagree 

agree 
nor  disagree 

Agree 

Strongly 

Agree 

i  1 

2 

3 

4 

5 

22 

23 


Nen'  ideas  are  readih*  acc^ted  here 

My  organization  is  qnick  to  re^ond  when  changes  need  to 
be  made 

Management  is  quick  to  spot  the  need  to  do  things 
differ  enth* 

This  organization  is  very  flexible;  it  can  qnickiy  change 
procedures  to  meet  new  conditions  and  sohe  problems  as 
tbe%'  arise 


How  mnch  do  yon  agree  with  each  of  the  following? 


26 


Stron^y 

Disagree 

Disagree 

1 

2 

NoAo'  agree  .  Strongiv 

..  Agree 

nor  disagree  Agree 

3  4  5 


My  organization's  computing  task  requirements  dosdy 
align  with  cloud  serdces  on  a  prh'ate  cloud 
27  Current  applications  can  be  easih'  adapted  to  the  cloud 


How  closeh'  do  yon  agree  with  the  following  statements? 

Strongly 

Disagree 

Disagree 

Neither  agree 
nor  disagree 

Agree 

Strongly 

Agree 

1 

^ 1 

^ , 

4 

5 

My  organization's  IT  infrastructure  currenth' supports 
clond  computing 

BE 

o 

:,g._ 

\mm\ 

i 

29 

30 


My  organization  can  efficiently  more  computing  needs  to 
clond  computing 

Cloud  computing  will  satish'  my  organization's  computing 
needs 


63H  complete 
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Section  IV:  Reforming  Federal  Information  Technology 

Management 


Strongly 

disagree 

Disagree 

Neitlio  agree 
nor  disagree 

.  Strongiv 

Agrte  . 

agree 

1 

^ 1 

3 

4  5 

Hcnr  closeh*  do  you  agree  with  tbe  foUoning  statements? 

I  am  comfortable  hosting  my  organization’s  mission 
L  applications  and  data  in  an  infrastrnctnre  managed  by  a 
commerdal  provider  (e.g.  Google  or  Amazon)? 

I  am  comfortable  hosting  my  organization's  mission 
\  applications  or  data  in  an  infrastrnctnre  managed  by 
another  fedo-al  agencv'  (e.g.  DiSA,  apps.gov'). 

I  am  comfortable  hosting  my  organization's  mission 
I  applications  or  data  in  an  infrastrnctnre  managed  by 
another  group  within  vnnr  organization  (e.g.  Area 
Processing  Centers). 

I  am  likeh'  to  retain  my  organization's  mission  applications 
I  or  data  within  yonr  own  group  (eg.  acquire,  maintain  and 
operate  all  aspects  from  software  to  hardware). 


Administrative  applications  include  websites,  e-mail,  office 
applications  and  data 


I  am  comfortable  hosting  my  organization's  administrative 
applications  and  data  in  an  infrastructure  managed  by  a 
commerdal  provide-  (e.g.  Google  or  Amazon). 

I  am  comfortable  hosting  my  organization's  administrative 
applications  and  data  in  an  infrastrnctnre  managed  by 
another  federal  agencv'fe.g.  DISA,  apps.gov). 

I  am  comfortable  hosting  my  organization's  administrative 
applications  and  data  in  an  infrastructure  managed  by 
another  group  within  venr  organization  (e.g.  ”Area 
Processing  Cento's”). 


Strongly 

disagree 


Strongly 

agree 


I  am  likeh*  to  r^ain  my  organization's  administrative 
applications  and  data  within  yonr  own  group  (e.g.  acquire, 
maintain  and  opoate  all  aspects  from  st^tware  to 
hardware). 


75®o  complete 
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VT\ri  1  survey 


I  iMaiiiuiK  lit  itertMakaai 


Fit-viability  of  Cloud  Computing  in  the  DoD 


Section  V:  Demographics 


39 

How  many  years  hare  worked  with  loformation 

TecfaBolog\'  (Compnters,  Networks,  Secarit^*) 

i  1 

40 

What  is  ii'ODr  edacatioa  le\'d? 

1  4 

41 

Which  of  the  foilowiag  best  describes  >'OBr  role  in  the 
orgaaizatioD? 

1  4 

42 

WTiat  le\-el  cf  inforaiatiofl  dassificatiofl  do  you  usually 
work  with? 

1  4 

[ir 

liMiat  is  >-onr  pay  grade? 

1  4 

44 

What  is  ^oar  age? 

45 

How  many  persomel  are  in  yoor  or^nization? 

i  4 

88®-o  complete 
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Appendix  D:  SmartPLS  Report 


Cross  Loadings 


cost 

fit 

inertia 

viability 

willingness 

COSTl 

1.000000 

-0.264952 

-0.175177 

-0.289511 

-0.264672 

FITl 

-0.236876 

0.852295 

0.185243 

0.481584 

0.320945 

FIT2 

-0.227624 

0.894746 

0.085833 

0.564070 

0.368675 

INERTIAlr 

-0.109283 

0.109694 

0.827469 

-0.201456 

-0.058347 

INERTIA2r 

-0.218048 

0.099498 

0.858527 

-0.148874 

-0.004516 

INERTIASr 

-0.110787 

0.160601 

0.811124 

-0.196712 

-0.049526 

INERTIA4r 

-0.175709 

0.115351 

0.783988 

-0.085278 

0.101325 

VIABILITYl 

-0.203887 

0.374463 

-0.260587 

0.804765 

0.319953 

VIABILITY2 

-0.178400 

0.452789 

-0.320048 

0.871319 

0.528174 

VIABILITY3 

-0.342609 

0.662744 

0.049104 

0.829887 

0.371739 

WILLI 

-0.243832 

0.270462 

0.022472 

0.431683 

0.867694 

WILL2 

-0.239663 

0.453971 

-0.002378 

0.432329 

0.876659 

WILLS 

-0.204982 

0.291138 

-0.020901 

0.454964 

0.899804 

WILL4 

-0.245830 

0.383365 

-0.091208 

0.428251 

0.882597 

AVE 


AVE 

cost 

1.000000 

fit 

0.763489 

inertia 

0.673584 

viability 

0.698519 

willingness 

0.777512 
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Outer  Loadings 


cost 

fit 

inertia 

viabiiity 

wiiiingness 

COSTl 

1.000000 

FITl 

0.852295 

FIT2 

0.894746 

INERTIAlr 

0.827469 

INERTIA2r 

0.858527 

INERTIASr 

0.811124 

INERTIA4r 

0.783988 

VIABILITYl 

0.804765 

VIABILITY2 

0.871319 

VIABILITY3 

0.829887 

WILLI 

0.867694 

WILL2 

0.876659 

WILLS 

0.899804 

WILL4 

0.882597 

Path  Coefficients 


cost 

fit 

inertia 

viability 

willingness 

cost 

-0.188419 

-0.132310 

fit 

0.601123 

inertia 

-0.332106 

viability 

0.457193 

willingness 
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